Regulatory and Compliance Standards Flashcards

What does the 'covered entity' designation under HIPAA include?

Answer: Health plans, healthcare clearinghouses, and healthcare providers that transmit PHI electronically

HIPAA defines covered entities as health plans, healthcare clearinghouses, and healthcare providers who transmit any health information in electronic form.

Which law requires that employees be offered continued group health coverage after certain qualifying events such as job loss?

Answer: COBRA

COBRA (Consolidated Omnibus Budget Reconciliation Act) allows employees and their families to continue group health plan coverage for a limited period after qualifying events like job loss or reduction in hours.

When a patient requests access to their own medical records under HIPAA, the covered entity must respond within:

Answer: 30 calendar days (with one possible 30-day extension)

HIPAA requires covered entities to act on a request to access PHI within 30 days, with a single 30-day extension available if the entity provides written notice of the reason for delay.

A Business Associate Agreement (BAA) is required under HIPAA when:

Answer: A covered entity shares PHI with a vendor who performs services on its behalf

A BAA is a contract that must be in place before a covered entity shares PHI with a business associate, establishing the permitted uses and safeguards required.

Under the Anti-Kickback Statute (AKS), which of the following is prohibited?

Answer: Offering or receiving remuneration to induce referrals of federal healthcare program business

The Anti-Kickback Statute prohibits offering, paying, soliciting, or receiving anything of value to induce or reward referrals of items or services covered by federal healthcare programs.

When a hospital provides Notice of Privacy Practices (NPP) to a new patient, the patient must:

Answer: Acknowledge receipt of the NPP in writing, though they are not required to agree to its terms

HIPAA requires patients to acknowledge receipt of the NPP, but providers cannot condition treatment on the patient's agreement to the NPP's terms.

Which of the following disclosures of PHI does NOT require patient authorization under HIPAA?

Answer: Disclosures required by law, such as mandatory public health reporting

HIPAA permits disclosures required by law, including mandatory reporting to public health authorities for disease surveillance and reporting, without patient authorization.