Professional Ethics & Legal Standards Flashcards

A patient's employer calls the nursing unit asking whether the patient will be able to return to work next week. What should the health unit coordinator do?

Answer: Politely decline to share any information without the patient's written authorization

Employers are not entitled to PHI without the patient's written authorization under HIPAA.

Under HIPAA's minimum necessary standard, which disclosure is EXEMPT from the requirement?

Answer: Disclosure to a health care provider for treatment purposes

Disclosures to providers for treatment are excluded from the minimum necessary standard.

When a patient requests access to a copy of their medical record, HIPAA generally requires the covered entity to act within how many days?

Answer: 30 days

Covered entities must act on access requests within 30 days, with one possible 30-day extension.

A patient submits a written request to amend information in their medical record. Under HIPAA, the facility must act on the request within:

Answer: 60 days

HIPAA allows covered entities 60 days to act on an amendment request, with one 30-day extension.

Following a breach of unsecured PHI, affected individuals must be notified without unreasonable delay and no later than:

Answer: 60 calendar days after discovery

The HIPAA Breach Notification Rule sets an outer limit of 60 calendar days after discovery.

A breach of unsecured PHI affects more than 500 residents of one state. In addition to notifying individuals and HHS, the facility must notify:

Answer: Prominent media outlets serving that state

Breaches affecting more than 500 residents of a state or jurisdiction require media notification.

Which type of health information requires a specific patient authorization for most disclosures, even for many treatment-related purposes?

Answer: Psychotherapy notes

HIPAA gives psychotherapy notes special protection, requiring separate authorization for most uses and disclosures.