NCMA HIPAA and Patient Privacy Rights 2

Question 1

Under HIPAA, what is a 'Business Associate Agreement' (BAA) and when is it required?

Accepted Answer

A contract required when a covered entity shares PHI with a third-party vendor or service provider that performs functions on its behalf

Answer

A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and any business associate (third party) that creates, receives, maintains, or transmits PHI on behalf of the covered entity. Examples include EHR vendors, billing companies, and shredding services.

Question 2

What are the three HIPAA safeguard categories under the Security Rule, which applies specifically to electronic PHI (ePHI)?

Accepted Answer

Administrative, physical, and technical safeguards

Answer

HIPAA's Security Rule requires covered entities to implement three types of safeguards for ePHI: Administrative (policies, training, risk analysis), Physical (facility access controls, workstation security, device controls), and Technical (access controls, audit controls, encryption).

Question 3

A medical assistant overhears a colleague discussing a patient's HIV status in the hospital cafeteria with another colleague. What is the appropriate action?

Accepted Answer

Politely remind the colleagues that discussing PHI in public areas violates HIPAA and report the incident to the privacy officer if necessary

Answer

Discussing identifiable patient information in public spaces (cafeteria, elevators, hallways) violates HIPAA even among healthcare workers. The minimum necessary standard and incidental disclosure rules prohibit unnecessary sharing of PHI in public areas.

Question 4

Under HIPAA, what must a covered entity do when a data breach affects 500 or more individuals?

Accepted Answer

Notify affected individuals, provide notice to prominent media outlets in affected states, and report to HHS (OCR) within 60 days of breach discovery

Answer

HIPAA's Breach Notification Rule for breaches affecting 500+ individuals requires: notification to affected individuals within 60 days, notice to prominent media outlets in affected states, and immediate notification to HHS OCR (which posts breaches publicly on the 'Wall of Shame').

Question 5

A patient requests that the medical office NOT share their PHI with their health insurance plan for a specific service they paid for entirely out of of-pocket. Under HIPAA, what must the covered entity do?

Accepted Answer

Honor the restriction request — this is a mandatory restriction covered entities must comply with under the HITECH Act

Answer

The HITECH Act (2009) amended HIPAA to mandate that covered entities must honor a patient's request to restrict disclosure to a health plan when: (1) the restriction applies to a specific item or service, AND (2) the patient has paid for the service in full out-of-pocket.

NCMA - National Certified Medical Assistant Practice Test

NCMA - National Certified Medical Assistant Practice Test

NCMA HIPAA and Patient Privacy Rights 2