MHA Health Law and Regulations 5 — Questions and Answers
Question 1: A healthcare organization discovers that an employee inappropriately accessed 500 patient records out of curiosity with no malicious intent. Under HIPAA, this is:
- Not a reportable breach because there was no malicious intent
- A breach that must be evaluated using the four-factor risk assessment (Correct answer)
- Automatically a reportable breach requiring notification to all 500 patients
- An internal workforce issue only requiring OSHA reporting
Correct answer: A breach that must be evaluated using the four-factor risk assessment
Under HIPAA, a security incident is presumed a reportable breach unless a risk assessment using four factors demonstrates a low probability that PHI was compromised.
Question 2: Title VI of the Civil Rights Act of 1964 requires healthcare organizations that receive federal financial assistance to:
- Provide sign language interpreters for all deaf patients at no charge
- Ensure equal access to services without discrimination based on race, color, or national origin (Correct answer)
- Maintain diverse medical staff proportional to the community's demographics
- Offer culturally specific treatment programs for all ethnic groups served
Correct answer: Ensure equal access to services without discrimination based on race, color, or national origin
Title VI prohibits discrimination based on race, color, and national origin in programs receiving federal funding, which includes most hospitals through Medicare and Medicaid.
Question 3: Under the Patient Self-Determination Act (PSDA), hospitals receiving Medicare/Medicaid funds must:
- Require all patients to execute an advance directive upon admission
- Inform patients of their rights to make healthcare decisions and inquire about advance directives (Correct answer)
- Honor all advance directives regardless of state law requirements
- Appoint a patient advocate for every admitted patient
Correct answer: Inform patients of their rights to make healthcare decisions and inquire about advance directives
The PSDA requires hospitals to inform patients of their rights to accept or refuse treatment and to create advance directives, and to document advance directive status in the medical record.
Question 4: Which standard governs how hospitals must handle requests from law enforcement for patient information without a court order or patient authorization?
- Law enforcement may access all patient records by presenting a badge
- HIPAA permits limited disclosures for law enforcement purposes subject to specific conditions (Correct answer)
- Hospitals must always require a subpoena before disclosing any patient information to law enforcement
- State law exclusively governs law enforcement access to medical records
Correct answer: HIPAA permits limited disclosures for law enforcement purposes subject to specific conditions
HIPAA permits certain law enforcement disclosures — such as pursuant to a court order, subpoena, or administrative request — but imposes conditions to protect patient privacy.
Question 5: A Medicare Advantage plan denies a medically necessary procedure. The enrollee's first step under federal appeals rights is to:
- File a complaint with the state insurance commissioner
- Request a redetermination from the Medicare Advantage plan (Correct answer)
- Appeal directly to an Independent Review Entity (IRE)
- File suit in federal district court
Correct answer: Request a redetermination from the Medicare Advantage plan
The Medicare appeals process begins with a redetermination request to the Medicare Advantage plan, followed by reconsideration, IRE review, ALJ hearing, and then federal court.
Question 6: The concept of 'informed consent' in healthcare law requires that a patient be told:
- Only the information the physician believes is relevant to the treatment decision
- The diagnosis, proposed treatment, material risks, alternatives, and consequences of refusal (Correct answer)
- All possible risks, no matter how remote or unlikely
- Only information that a reasonable physician would disclose
Correct answer: The diagnosis, proposed treatment, material risks, alternatives, and consequences of refusal
Valid informed consent requires disclosure of the diagnosis, proposed treatment, material risks and benefits, reasonable alternatives, and consequences of refusing treatment.
Question 7: A health system acquires a competing hospital, reducing the number of hospitals in the market from four to three. Which federal agency has primary authority to review this transaction for anticompetitive effects?
- Office of Inspector General (OIG)
- Centers for Medicare & Medicaid Services (CMS)
- Federal Trade Commission (FTC) (Correct answer)
- Department of Health and Human Services (HHS)
Correct answer: Federal Trade Commission (FTC)
The FTC has primary antitrust enforcement authority over hospital mergers and acquisitions and reviews transactions that may substantially lessen competition in healthcare markets.
MHA Health Law and Regulations 5
A healthcare organization discovers that an employee inappropriately accessed 500 patient records out of curiosity with no malicious intent.
Under HIPAA, this is: