MS Medical Scribe Compliance & HIPAA Regulations 3 — Questions and Answers
Question 1: A business associate agreement (BAA) is required when:
- A physician discusses a case with another physician in the same practice
- A hospital hires a transcription company that will access PHI (Correct answer)
- A patient requests their records be sent to a specialist
- A nurse verbally reports to the incoming shift nurse
Correct answer: A hospital hires a transcription company that will access PHI
A BAA is required when a covered entity engages a business associate — such as a transcription company — that will create, receive, maintain, or transmit PHI on their behalf.
Question 2: Under the HIPAA Breach Notification Rule, how soon must a covered entity notify affected individuals of a breach?
- Immediately upon discovery
- Within 30 days of discovery
- Within 60 days of discovery (Correct answer)
- Within 60 days of the end of the calendar year
Correct answer: Within 60 days of discovery
Covered entities must notify affected individuals without unreasonable delay and within 60 days of discovering a breach.
Question 3: If a breach affects 500 or more individuals in a single state, the covered entity must notify:
- The state attorney general only
- Prominent media outlets serving the state (Correct answer)
- The FBI cybercrime division
- The Joint Commission
Correct answer: Prominent media outlets serving the state
When a breach affects 500 or more residents of a state or jurisdiction, the covered entity must notify prominent media outlets in addition to HHS and affected individuals.
Question 4: Which of the following scenarios constitutes a HIPAA violation by a medical scribe?
- Sharing de-identified patient data with a quality improvement committee
- Discussing a patient's case with the treating physician in a private exam room
- Texting a patient's full name and diagnosis to a friend who is also a nurse (Correct answer)
- Documenting a patient's HIV status at the physician's direction
Correct answer: Texting a patient's full name and diagnosis to a friend who is also a nurse
Sharing a patient's identifiable health information with unauthorized individuals — even healthcare workers with no need-to-know — constitutes a HIPAA violation.
Question 5: What is the purpose of a HIPAA Notice of Privacy Practices (NPP)?
- To document that a patient consented to treatment
- To inform patients of their rights and how their PHI may be used (Correct answer)
- To authorize release of records to insurance companies
- To grant business associates permission to access ePHI
Correct answer: To inform patients of their rights and how their PHI may be used
The NPP informs patients of their privacy rights and describes how the covered entity may use and disclose their PHI.
Question 6: A medical scribe working for a telemedicine company is considered a:
- Covered entity
- Business associate (Correct answer)
- Hybrid entity
- Workforce member only if employed full-time
Correct answer: Business associate
A medical scribe employed by or contracted with a covered entity is part of the covered entity's workforce, but a scribe company is a business associate of the healthcare provider.
Question 7: Which activity is permitted without patient authorization under the HIPAA Privacy Rule's treatment, payment, and operations (TPO) exceptions?
- Sending PHI to a patient's employer for annual wellness reporting
- Sharing records with a referring specialist for continuity of care (Correct answer)
- Releasing psychiatric notes to a life insurance company
- Providing records to an attorney for legal proceedings
Correct answer: Sharing records with a referring specialist for continuity of care
Sharing records with a referring specialist falls under 'treatment' and is permitted without patient authorization under the TPO exception.
MS Medical Scribe Compliance & HIPAA Regulations 3
A business associate agreement (BAA) is required when: