CHPC Healthcare Privacy Regulations Questions and Answers

Question 1

A hospital discovers that a billing employee impermissibly accessed the electronic health records of 550 patients out of curiosity. According to the HITECH Act's breach notification rule, which of the following actions is the hospital required to take?

Accepted Answer

Notify the affected individuals, the Secretary of HHS, and prominent media outlets in the state.

Answer

The HITECH Act requires covered entities to notify affected individuals, the Secretary of Health and Human Services (HHS), and, in cases involving more than 500 residents of a single state or jurisdiction, prominent media outlets. The notification must occur without unreasonable delay and no later than 60 days from the breach's discovery. Since this breach affected 550 patients, all three notification requirements are triggered.

Question 2

Which of the following is a core patient right guaranteed under the HIPAA Privacy Rule?

Accepted Answer

The right to access and obtain a copy of their protected health information (PHI).

Answer

The HIPAA Privacy Rule provides individuals with the right to access, inspect, and obtain a copy of their PHI from a covered entity in a designated record set. While they can request amendments, they cannot demand complete deletion of records that providers are legally required to maintain. Their right to restrict disclosures for TPO (Treatment, Payment, Operations) is limited, and they do not have a right to audit internal security logs.

Question 3

A pharmaceutical company offers to pay a hospital for a list of patients diagnosed with a specific condition to send them marketing materials about a new drug. Under HIPAA marketing rules, what must the hospital do before disclosing this PHI?

Accepted Answer

Obtain a valid, written authorization from each individual patient.

Answer

The HIPAA Privacy Rule defines this type of communication as marketing, especially since the hospital receives remuneration. For nearly all marketing purposes that involve the use or disclosure of PHI and involve payment to the covered entity, a specific, written authorization from the patient is required. A Business Associate Agreement or a notice in the NPP is insufficient for this purpose.

Question 4

A Privacy Officer is developing a policy based on the 'Minimum Necessary' standard. Which of the following scenarios best demonstrates the correct application of this HIPAA principle?

Accepted Answer

Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims.

Answer

The 'Minimum Necessary' standard, a key principle of the HIPAA Privacy Rule, requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose. Granting a billing clerk access only to the specific data elements required for their job function is a perfect example of this role-based access control. The other options represent overly broad disclosures of PHI.

Question 5

A business associate discovers a breach of unsecured PHI that it maintains on behalf of a covered entity. What is the business associate's primary notification responsibility under the HITECH Act?

Accepted Answer

Notify the covered entity without unreasonable delay and in no case later than 60 days of discovery.

Answer

Under the HITECH Act and the HIPAA Final Omnibus Rule, a business associate must notify the covered entity of a breach of unsecured PHI. This notification allows the covered entity to fulfill its own breach notification duties to individuals, HHS, and potentially the media. The contract (Business Associate Agreement) between the two parties will often specify a shorter timeframe for this internal notification, but the outer limit aligns with the 60-day rule.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Healthcare Privacy Regulations Questions and Answers