HIPAA - Health Insurance Portability and Accountability Act The HIPAA Privacy Rule Questions and Answers

Question 1

A hospital billing department needs to send a list of patient accounts to a third-party collection agency. According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following actions is most appropriate?

Accepted Answer

Disclose only the demographic and financial information necessary for collection purposes.

Answer

The 'minimum necessary' standard requires covered entities to make reasonable efforts to limit the use or disclosure of Protected Health Information (PHI) to the minimum necessary to accomplish the intended purpose. For debt collection, this includes demographic information to identify and locate the individual and financial information about the debt, but not their entire clinical history.

Question 2

Under the HIPAA Privacy Rule, which of the following is NOT considered Protected Health Information (PHI)?

Accepted Answer

A de-identified health summary used for a statistical study.

Answer

Protected Health Information (PHI) is individually identifiable health information. Information that has been de-identified, meaning all 18 specific identifiers (like name, address, dates, etc.) have been removed, is no longer considered PHI and is not subject to the Privacy Rule.

Question 3

A patient exercises their right to access their PHI and requests a copy of their medical records from a covered entity. The covered entity has a policy of charging a flat fee of $100 for all record requests to cover costs. This policy is:

Accepted Answer

Not permissible, as covered entities can only charge a reasonable, cost-based fee and must inform the patient of the approximate fee in advance.

Answer

The HIPAA Privacy Rule allows covered entities to charge a reasonable, cost-based fee for copies of PHI. This fee can only include the cost of labor for copying, supplies (e.g., paper, CD), and postage. A flat fee is generally not permissible unless the entity can show it is a reasonable estimate of average costs. Patients have a right to be informed of the approximate fee beforehand.

Question 4

In which of the following scenarios is a covered entity permitted to disclose PHI without the patient's authorization?

Accepted Answer

To a public health authority for disease surveillance purposes as required by law.

Answer

The HIPAA Privacy Rule permits disclosures without individual authorization for specific public interest and benefit activities. This includes disclosures to a public health authority (like the CDC or a state health department) that is legally authorized to collect or receive such information for purposes like preventing or controlling disease.

Question 5

A patient's friend calls a hospital and asks for an update on the patient's condition. The patient is conscious and able to make their own decisions. According to the HIPAA Privacy Rule, what should the hospital staff do?

Accepted Answer

Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure.

Answer

If the patient has the capacity to make their own decisions, the covered entity must provide them with the opportunity to agree or object to the disclosure of their information to family, friends, or others involved in their care. The staff should ask the patient for permission before sharing any information.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act The HIPAA Privacy Rule Questions and Answers