MHA Health Law and Regulations 4 — Questions and Answers
Question 1: Under the Health Insurance Portability and Accountability Act (HIPAA), a covered entity may disclose PHI without patient authorization for which purpose?
- Marketing a new pharmaceutical product
- Public health activities such as disease surveillance (Correct answer)
- Employment background checks requested by the patient's employer
- Research conducted by a for-profit company without IRB oversight
Correct answer: Public health activities such as disease surveillance
HIPAA permits disclosure of PHI without authorization for public health purposes, including reporting diseases and tracking vital statistics, under the public interest exception.
Question 2: The Anti-Kickback Statute (AKS) criminalizes offering or receiving remuneration to induce referrals for services covered by federal healthcare programs. Which of the following is a recognized 'safe harbor'?
- Paying physicians above-market rates for medical directorships
- Discounts that are properly disclosed and reflected in the cost reports submitted to the government (Correct answer)
- Providing free equipment to physicians who refer patients
- Waiving copayments for all Medicare patients as a marketing strategy
Correct answer: Discounts that are properly disclosed and reflected in the cost reports submitted to the government
The discount safe harbor protects properly disclosed price reductions provided to purchasers that are accurately reported to the government.
Question 3: A state law conflicts with a federal HIPAA privacy standard. Which standard applies?
- The federal HIPAA standard always prevails under the Supremacy Clause
- The more protective (stricter) standard — federal or state — applies (Correct answer)
- The state standard applies because health is traditionally a state police power
- The standard favored by the state insurance commissioner applies
Correct answer: The more protective (stricter) standard — federal or state — applies
HIPAA sets a federal floor; states may enact stricter privacy laws, and whichever standard provides greater privacy protection to individuals applies.
Question 4: Which legal doctrine protects peer review documents from discovery in malpractice litigation in most states?
- Attorney-client privilege
- Work product doctrine
- Peer review privilege / medical staff privilege (Correct answer)
- HIPAA research exemption
Correct answer: Peer review privilege / medical staff privilege
Most states have enacted peer review privilege statutes that shield quality improvement and credentialing deliberations from discovery to encourage candid self-assessment.
Question 5: Under the Affordable Care Act, insurance companies are prohibited from denying coverage based on pre-existing conditions under the principle known as:
- Guaranteed renewability
- Guaranteed issue (Correct answer)
- Community rating
- Essential health benefits mandate
Correct answer: Guaranteed issue
Guaranteed issue requires insurers to accept all applicants regardless of health status or pre-existing conditions.
Question 6: A hospital is implementing a new EHR system. Under HIPAA's Security Rule, which of the following is required?
- Encrypting all PHI at rest in all circumstances without exception
- Conducting a risk analysis to identify potential vulnerabilities to ePHI (Correct answer)
- Storing ePHI only on servers located within the United States
- Obtaining patient consent before storing health information electronically
Correct answer: Conducting a risk analysis to identify potential vulnerabilities to ePHI
The HIPAA Security Rule requires covered entities to conduct an accurate and thorough risk analysis of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.
Question 7: When a hospital enters into a Business Associate Agreement (BAA) under HIPAA, the business associate:
- Becomes a covered entity and must comply with all HIPAA provisions
- Assumes direct liability for HIPAA compliance with respect to PHI it receives (Correct answer)
- Is exempt from state privacy laws for the duration of the agreement
- Has no liability if the covered entity fails to notify them of new regulations
Correct answer: Assumes direct liability for HIPAA compliance with respect to PHI it receives
Under the HITECH Act amendments to HIPAA, business associates are directly liable for HIPAA compliance obligations with respect to PHI they create, receive, maintain, or transmit.
MHA Health Law and Regulations 4
Under the Health Insurance Portability and Accountability Act (HIPAA), a covered entity may disclose PHI without patient authorization for which purpose?