Medical Scribe Compliance & HIPAA Regulations Flashcards

A business associate agreement (BAA) is required when:

Answer: A hospital hires a transcription company that will access PHI

A BAA is required when a covered entity engages a business associate — such as a transcription company — that will create, receive, maintain, or transmit PHI on their behalf.

Under the HIPAA Breach Notification Rule, how soon must a covered entity notify affected individuals of a breach?

Answer: Within 60 days of discovery

Covered entities must notify affected individuals without unreasonable delay and within 60 days of discovering a breach.

If a breach affects 500 or more individuals in a single state, the covered entity must notify:

Answer: Prominent media outlets serving the state

When a breach affects 500 or more residents of a state or jurisdiction, the covered entity must notify prominent media outlets in addition to HHS and affected individuals.

Which of the following scenarios constitutes a HIPAA violation by a medical scribe?

Answer: Texting a patient's full name and diagnosis to a friend who is also a nurse

Sharing a patient's identifiable health information with unauthorized individuals — even healthcare workers with no need-to-know — constitutes a HIPAA violation.

What is the purpose of a HIPAA Notice of Privacy Practices (NPP)?

Answer: To inform patients of their rights and how their PHI may be used

The NPP informs patients of their privacy rights and describes how the covered entity may use and disclose their PHI.

A medical scribe working for a telemedicine company is considered a:

Answer: Business associate

A medical scribe employed by or contracted with a covered entity is part of the covered entity's workforce, but a scribe company is a business associate of the healthcare provider.

Which activity is permitted without patient authorization under the HIPAA Privacy Rule's treatment, payment, and operations (TPO) exceptions?

Answer: Sharing records with a referring specialist for continuity of care

Sharing records with a referring specialist falls under 'treatment' and is permitted without patient authorization under the TPO exception.