Regulatory Compliance & Health Privacy Laws Flashcards

Under HIPAA, which of the following is considered a 'limited data set' that requires a data use agreement?

Answer: Data with most direct identifiers removed but may include dates and geographic subdivisions

A limited data set removes most direct identifiers but may retain dates, geographic subdivisions larger than a street address, and other indirect identifiers, requiring a data use agreement.

A patient requests an amendment to their medical record because they believe it contains an error. Under HIPAA, how long does a covered entity have to act on this request?

Answer: 60 days

HIPAA requires covered entities to act on a request for amendment within 60 days, with one possible 30-day extension if the entity notifies the individual in writing.

Which federal law specifically governs the privacy of substance use disorder treatment records at federally assisted programs?

Answer: 42 CFR Part 2

42 CFR Part 2 provides stricter confidentiality protections for substance use disorder patient records at federally assisted programs than HIPAA.

A Patient Access Representative receives a subpoena for a patient's medical records. What is the MOST appropriate first action?

Answer: Forward the subpoena to the facility's legal counsel or privacy officer

Subpoenas require legal review before release; the privacy officer or legal counsel determines whether the subpoena meets HIPAA requirements for disclosure.

Under the HITECH Act, which of the following organizations are directly liable for HIPAA compliance?

Answer: Both covered entities and business associates

The HITECH Act extended direct HIPAA liability to business associates, not just covered entities, making both directly subject to enforcement.

The EMTALA law requires hospitals with emergency departments to provide what to all patients regardless of insurance status?

Answer: A medical screening examination and stabilizing treatment

EMTALA mandates that hospitals provide a medical screening examination to all patients and stabilizing treatment for emergency medical conditions, regardless of ability to pay.

Which of the following is NOT one of the four HIPAA enforcement tiers of civil monetary penalties?

Answer: Violation due to criminal intent with personal financial gain

Criminal intent with personal financial gain is addressed under HIPAA criminal penalties, not civil monetary penalty tiers, which range from unknowing violations to uncorrected willful neglect.