MT Privacy Regulations & Ethical Practices 3 — Questions and Answers
Question 1: Under what circumstance may a medical transcriptionist disclose PHI without patient authorization?
- When a curious colleague asks about a well-known patient
- When required by law, such as mandatory reporting of certain communicable diseases (Correct answer)
- When the patient's family insists on knowing the diagnosis
- When a local news reporter claims it is in the public interest
Correct answer: When required by law, such as mandatory reporting of certain communicable diseases
HIPAA permits disclosure of PHI without authorization when required by law, including public health activities and mandatory disease reporting.
Question 2: A Business Associate Agreement (BAA) under HIPAA must be executed between a covered entity and which party?
- Any vendor that provides cleaning services to the facility
- A transcription company that receives and processes PHI on behalf of the covered entity (Correct answer)
- The state health department that oversees the facility
- Insurance company representatives who visit the facility
Correct answer: A transcription company that receives and processes PHI on behalf of the covered entity
A BAA is required when a third-party vendor (business associate) creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Question 3: Which of the following constitutes a HIPAA breach requiring notification?
- An employee views a record for a patient they are currently treating
- A transcriptionist accidentally sends a completed report to the wrong physician's secure portal (Correct answer)
- A physician dictates a report from an encrypted hospital telephone system
- A billing department queries the database using de-identified patient data
Correct answer: A transcriptionist accidentally sends a completed report to the wrong physician's secure portal
Sending PHI to the wrong recipient is an impermissible disclosure that constitutes a breach unless the covered entity can demonstrate low probability of compromise.
Question 4: In medical transcription ethics, 'fidelity' refers to:
- Keeping accurate financial records for billing purposes
- Being loyal to professional duties and fulfilling obligations to employers and clients (Correct answer)
- Using high-fidelity audio equipment for dictation playback
- Following only the most recently updated transcription guidelines
Correct answer: Being loyal to professional duties and fulfilling obligations to employers and clients
Fidelity in the MT Code of Ethics means loyalty and faithfulness to professional obligations, including commitments to employers, clients, and patients.
Question 5: Safe harbor de-identification of PHI under HIPAA requires removal of how many specific identifiers?
- 10 identifiers
- 15 identifiers
- 18 identifiers (Correct answer)
- 22 identifiers
Correct answer: 18 identifiers
HIPAA's Safe Harbor method requires removal of 18 specific types of identifiers to de-identify health information.
Question 6: A medical transcriptionist overhears a coworker discussing a patient's diagnosis loudly in a public hallway. This is an example of violating:
- The HIPAA Security Rule regarding technical safeguards
- The HIPAA Privacy Rule regarding incidental disclosures (Correct answer)
- The HITECH Act's breach notification requirements
- OSHA workplace safety standards
Correct answer: The HIPAA Privacy Rule regarding incidental disclosures
Discussing PHI in public areas where it can be overheard violates the HIPAA Privacy Rule, which requires reasonable safeguards to prevent incidental disclosures.
Question 7: When a patient revokes a previously signed HIPAA authorization, the revocation:
- Is effective immediately for all past and future disclosures
- Is effective for future disclosures but does not apply to actions already taken in reliance on the authorization (Correct answer)
- Must be submitted in writing and approved by the covered entity's privacy officer before taking effect
- Automatically cancels all medical records associated with the authorization
Correct answer: Is effective for future disclosures but does not apply to actions already taken in reliance on the authorization
A patient can revoke an authorization at any time, but the revocation does not affect uses or disclosures already made under the original authorization.
MT Privacy Regulations & Ethical Practices 3
Under what circumstance may a medical transcriptionist disclose PHI without patient authorization?