NCMA HIPAA and Patient Privacy Rights

Question 1

Under HIPAA, what does 'PHI' stand for, and what does it include?

Accepted Answer

Protected Health Information — individually identifiable health information held by covered entities

Answer

PHI (Protected Health Information) is individually identifiable health information created, received, or maintained by a covered entity in any form (electronic, paper, verbal) that relates to past, present, or future physical/mental health conditions, healthcare provided, or payment for care.

Question 2

Which of the following represents a HIPAA-permitted disclosure of PHI WITHOUT the patient's written authorization?

Accepted Answer

Disclosing immunization records to a patient's school for enrollment

Answer

HIPAA permits disclosure of immunization records to schools without patient authorization when state law requires such proof. This falls under the 'required by law' exception. The other options require explicit patient authorization.

Question 3

What is the HIPAA 'Minimum Necessary' standard, and how does it apply in daily practice?

Accepted Answer

Only the minimum amount of PHI necessary to accomplish the intended purpose should be used, disclosed, or requested

Answer

The Minimum Necessary standard requires covered entities to make reasonable efforts to limit use and disclosure of PHI to the minimum amount needed to accomplish the intended purpose. Staff should only access what they need for their specific job function.

Question 4

A patient calls the medical office requesting a copy of their own medical records. Under HIPAA, what are the patient's rights?

Accepted Answer

Patients have the right to access and obtain copies of their PHI, typically within 30 days, with a possible 30-day extension

Answer

HIPAA's Privacy Rule grants patients the right to access and obtain copies of their PHI maintained in a designated record set. Covered entities must respond within 30 days, with one 30-day extension allowed with written notice.

Question 5

What is the correct action when a medical assistant accidentally views a celebrity patient's medical record while searching for another patient with a similar name?

Accepted Answer

Immediately close the record, report the accidental access to the supervisor, and document the incident per facility policy

Answer

Even accidental access to the wrong patient's PHI is a privacy incident. The correct response is to close the record immediately, report to the supervisor/privacy officer, and document the incident per facility policy — which is required for HIPAA breach assessment.

NCMA - National Certified Medical Assistant Practice Test

NCMA - National Certified Medical Assistant Practice Test

NCMA HIPAA and Patient Privacy Rights