CHPC - Certified in Healthcare Privacy Compliance Healthcare Privacy Laws and Regulations Questions and Answers

Question 1

A research institution wants to use a dataset containing PHI for a study. To comply with HIPAA, they must de-identify the data. Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?

Accepted Answer

The Expert Determination Method

Answer

The HIPAA Privacy Rule provides two methods for de-identification. The Expert Determination Method involves a qualified expert applying statistical or scientific principles to determine that the risk is 'very small' that the information could be used to identify an individual. The Safe Harbor method involves removing 18 specific identifiers.

Question 2

A patient discovers an error in their medical record and submits a written request to their provider to correct it. Under the HIPAA Privacy Rule, what is the covered entity's primary obligation regarding the patient's right to amend their PHI?

Accepted Answer

To review the request and, if granted, append the correction to the record.

Answer

The HIPAA Privacy Rule gives individuals the right to request amendment of their PHI in a designated record set. The covered entity is not required to delete the original information but must, if it accepts the amendment, append the corrected information and notify relevant parties. The entity can deny the request for specific reasons, such as if it determines the record is accurate and complete.

Question 3

A hospital's business associate, a billing company, experiences a data breach involving unsecured PHI. According to the HITECH Act's Breach Notification Rule, what is the business associate's direct responsibility?

Accepted Answer

Notify the covered entity of the breach without unreasonable delay and no later than 60 days following discovery.

Answer

Under the HITECH Act, a business associate must notify the covered entity of a breach of unsecured PHI 'without unreasonable delay and in no case later than 60 calendar days' after discovery. The covered entity is ultimately responsible for notifying the affected individuals, HHS, and, if applicable, the media.

Question 4

A state has a law requiring that patients provide specific consent for the release of mental health records, a standard more stringent than HIPAA's general authorization requirements. A provider in this state receives a request that is compliant with HIPAA but not with the stricter state law. Which of the following is the correct course of action?

Accepted Answer

Follow the more stringent state law.

Answer

The HIPAA Privacy Rule acts as a federal floor for privacy protection. It does not preempt state laws that are 'more stringent,' meaning those that provide greater privacy protections to individuals. In this case, the provider must comply with the state law that offers greater protection to the patient's information.

Question 5

A covered entity wishes to send promotional materials to its former patients about a new, non-health-related service, such as a financial planning workshop hosted by a third party. Under the HIPAA Privacy Rule, which of the following is required before using PHI for this purpose?

Accepted Answer

A valid, written authorization from each individual.

Answer

Using or disclosing PHI for marketing purposes generally requires a specific, written authorization from the individual. This authorization must be in plain language and clearly state how the information will be used. Communications about third-party products or services that involve remuneration are considered marketing and are not covered under treatment, payment, or healthcare operations exceptions.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Healthcare Privacy Laws and Regulations Questions and Answers