Regulatory Compliance & Health Privacy Laws Flashcards

A patient is incapacitated in the ER. Under HIPAA, who may give permission to release PHI to family members present?

Answer: A licensed physician who determines it is in the patient's best interest

When a patient is incapacitated, a licensed healthcare professional may use professional judgment to share PHI with family or friends involved in the patient's care if it is in the patient's best interest.

What does the 'minimum necessary' standard under HIPAA require of Patient Access Representatives?

Answer: Limiting PHI disclosures to the smallest amount needed to accomplish the purpose

The minimum necessary standard requires that covered entities limit PHI uses and disclosures to the least amount needed to accomplish the intended purpose.

Under the No Surprises Act, which of the following patients are protected from unexpected out-of-network bills?

Answer: Insured patients receiving emergency care or non-emergency care at in-network facilities from out-of-network providers

The No Surprises Act protects insured patients from surprise bills for emergency services and for non-emergency services at in-network facilities from out-of-network providers without prior consent.

A patient verbally requests that information about their visit not be shared with their spouse. Under HIPAA, the facility must:

Answer: Honor the restriction if it does not interfere with the patient's treatment

Patients have the right to request restrictions on PHI disclosures, and while facilities are not required to agree to all restrictions, they must honor any restriction agreed upon.

Which CMS Condition of Participation requires hospitals to inform patients of their rights before or at the point of admission?

Answer: The Patient Rights CoP (42 CFR 482.13)

The CMS Patient Rights Condition of Participation (42 CFR 482.13) requires hospitals to inform each patient of their rights before or at admission.

Under HIPAA's Right of Access rule, what is the maximum fee a covered entity can charge for providing medical records in electronic format to the patient?

Answer: A flat fee not to exceed $6.50 when records are provided electronically

OCR guidance allows a flat fee of no more than $6.50 for electronic copies of PHI provided directly to the patient, as an alternative to calculating actual costs.

A breach notification under HIPAA must be sent to affected individuals within how many days of discovering the breach?

Answer: 60 days

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach.