HMCC Privacy & Data Security — Questions and Answers
Question 1: What is the HIPAA Privacy Rule?
- Federal regulations establishing standards for how covered entities must protect and handle patients' protected health information (Correct answer)
- A rule about keeping medical offices clean
- A regulation about patient visiting hours
- A law about hospital noise levels
Correct answer: Federal regulations establishing standards for how covered entities must protect and handle patients' protected health information
The Privacy Rule establishes national standards for the use and disclosure of PHI by covered entities (health plans, healthcare clearinghouses, providers), including patient rights to access and control their health information.
Question 2: What is the HIPAA Security Rule?
- Federal regulations requiring covered entities to implement administrative, physical, and technical safeguards to protect electronic PHI (Correct answer)
- A rule about hospital building security
- A regulation about drug storage security
- A law about patient identification
Correct answer: Federal regulations requiring covered entities to implement administrative, physical, and technical safeguards to protect electronic PHI
The Security Rule requires covered entities to ensure the confidentiality, integrity, and availability of electronic PHI through administrative safeguards (policies, training), physical safeguards (facility access), and technical safeguards (encryption, access controls).
Question 3: What is a Business Associate Agreement (BAA)?
- A contract between a covered entity and a business associate that establishes permitted uses and required protections for PHI (Correct answer)
- A general partnership agreement
- An agreement between two hospitals to share patients
- A vendor payment contract
Correct answer: A contract between a covered entity and a business associate that establishes permitted uses and required protections for PHI
BAAs are required when covered entities share PHI with business associates (billing companies, IT vendors, cloud providers). The agreement specifies how the associate will protect PHI and report breaches.
Question 4: What is the HIPAA Breach Notification Rule?
- A requirement to notify affected individuals, HHS, and sometimes the media when unsecured PHI is accessed or disclosed without authorization (Correct answer)
- A rule about notifying patients of appointment changes
- A regulation about reporting medication errors
- A law about building evacuation procedures
Correct answer: A requirement to notify affected individuals, HHS, and sometimes the media when unsecured PHI is accessed or disclosed without authorization
The Breach Notification Rule requires notification to affected individuals within 60 days, to HHS (and media for breaches affecting 500+ individuals), with specific content requirements for each notification.
Question 5: What is the minimum necessary standard under HIPAA?
- The requirement to limit PHI use, disclosure, and requests to the minimum amount necessary to accomplish the intended purpose (Correct answer)
- Using the smallest possible font for medical records
- Keeping medical records as short as possible
- Limiting hospital staff to the minimum number
Correct answer: The requirement to limit PHI use, disclosure, and requests to the minimum amount necessary to accomplish the intended purpose
The minimum necessary standard requires covered entities to make reasonable efforts to use, disclose, and request only the minimum PHI needed for the particular purpose, limiting unnecessary exposure of patient information.
Question 6: What are a patient's rights under the HIPAA Privacy Rule?
- Right to access their records, request amendments, receive an accounting of disclosures, request restrictions, and receive a notice of privacy practices (Correct answer)
- Patients have no rights regarding their health information
- Only the right to view records at the hospital
- Only the right to request paper copies
Correct answer: Right to access their records, request amendments, receive an accounting of disclosures, request restrictions, and receive a notice of privacy practices
HIPAA grants patients significant rights: accessing and obtaining copies of their PHI, requesting corrections, knowing who has received their information, requesting communication preferences, and understanding privacy practices.
HMCC Privacy & Data Security
What is the HIPAA Privacy Rule?