Legislation and Regulations (HIPAA) Flashcards

A staff interpreter is asked to look up a patient's full medical history before a short discharge-instructions encounter. Which HIPAA principle should guide how much information the interpreter accesses?

Answer: The minimum necessary standard

The minimum necessary standard limits use and disclosure of PHI to only what is needed for the task.

Under the HIPAA Breach Notification Rule, a covered entity must notify affected individuals of a breach of unsecured PHI no later than how many calendar days after discovery?

Answer: 60 days

Individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery of the breach.

A breach of unsecured PHI affects more than 500 residents of a single state. In addition to notifying individuals and HHS, whom must the covered entity notify?

Answer: Prominent media outlets serving that state

Breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets serving that area.

A hospital contracts with an outside language services agency to provide interpreters. What document does HIPAA require between the hospital and the agency?

Answer: A Business Associate Agreement

Outside vendors that handle PHI on behalf of a covered entity are business associates and must sign a Business Associate Agreement.

Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?

Answer: The HHS Office for Civil Rights

The Office for Civil Rights within HHS enforces the HIPAA Privacy, Security, and Breach Notification Rules.

After a difficult session, an interpreter describes the patient's diagnosis by name to a colleague in a crowded hospital elevator. How is this best classified under HIPAA?

Answer: A violation because reasonable safeguards were not used

Incidental disclosures are only permitted when reasonable safeguards are applied, and discussing identifiable PHI in a public elevator fails that test.

A patient asks, through an interpreter, for a copy of their medical records. Under HIPAA, how long does the covered entity generally have to act on the request?

Answer: 30 days, with one possible 30-day extension

Covered entities must act on access requests within 30 days and may take one 30-day extension with written notice.