HIPAA Privacy & Security Rules Flashcards

Which of the following is a HIPAA-required element of a valid patient authorization for use or disclosure of PHI?

Answer: A description of the information to be used or disclosed

A valid HIPAA authorization must include a description of the PHI to be used or disclosed, among other required core elements specified in the Privacy Rule.

When a medical transcriptionist works on dictation containing substance abuse treatment records governed by 42 CFR Part 2, how do these records differ from standard HIPAA PHI?

Answer: They have stronger protections with stricter consent requirements than standard HIPAA rules

Substance abuse treatment records under 42 CFR Part 2 carry stricter confidentiality protections than HIPAA, requiring specific written consent for most disclosures including treatment.

A covered entity experiences a security incident where ransomware encrypts ePHI. Under HIPAA, what must the entity do within 60 days of discovering the breach if it affects more than 500 individuals in a state?

Answer: Notify affected individuals, the Secretary of HHS, and prominent media outlets in the affected state

For breaches affecting 500 or more individuals in a state, covered entities must notify affected individuals, HHS Secretary, and prominent media outlets in that state within 60 days.

What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

Answer: To contractually require the business associate to appropriately safeguard PHI and comply with HIPAA

A BAA contractually obligates business associates to use appropriate safeguards, report breaches, and comply with applicable HIPAA provisions regarding PHI they handle.

Under the HIPAA Privacy Rule's 'Minimum Necessary' standard, which of the following is EXEMPT from the requirement?

Answer: Disclosures to another provider for treatment of the patient

The Minimum Necessary Standard does not apply to disclosures made to or requested by a healthcare provider for treatment purposes.

A transcription company employee verbally shares a patient's diagnosis with a friend who works at a different hospital. Which HIPAA violation category best describes this conduct?

Answer: Unauthorized disclosure — impermissible use of PHI

Verbally sharing a patient's PHI with an unauthorized individual outside the covered entity constitutes an impermissible unauthorized disclosure under the HIPAA Privacy Rule.

Which of the following best describes the HIPAA 'Accounting of Disclosures' right?

Answer: A patient's right to obtain a list of certain disclosures of their PHI made without their authorization

The Accounting of Disclosures right allows patients to request a list of disclosures of their PHI made without authorization, covering a six-year period, with certain exceptions.