Regulatory Compliance & Health Privacy Laws Flashcards

Which of the following best describes a 'business associate agreement' (BAA) under HIPAA?

Answer: A written contract ensuring a vendor handling PHI on behalf of a covered entity will protect that information

A BAA is a written contract that requires a business associate — a vendor handling PHI on behalf of a covered entity — to appropriately safeguard that information.

Under HIPAA, psychotherapy notes receive special protection. Which of the following actions requires a patient's specific written authorization?

Answer: Both B and C

Psychotherapy notes require specific patient authorization for most uses and disclosures, including for payment and training purposes; they cannot be released even for treatment without special authorization in most cases.

A patient calls to ask about a family member's condition. The family member is a current inpatient. Under HIPAA, the facility may:

Answer: Share general condition information (e.g., 'stable') if the patient has not opted out of the facility directory

HIPAA's facility directory provisions allow staff to share limited information — such as general condition and location — with callers who ask for the patient by name, unless the patient has opted out.

The False Claims Act imposes liability on individuals or companies that knowingly submit which of the following to federal healthcare programs?

Answer: False or fraudulent claims for reimbursement

The False Claims Act imposes civil liability on those who knowingly submit false or fraudulent claims to Medicare, Medicaid, or other federal programs, with penalties per false claim.

Under HIPAA, which of the following is an example of a permissible disclosure of PHI WITHOUT patient authorization?

Answer: Reporting a communicable disease to the state public health department

HIPAA permits disclosure of PHI to public health authorities for activities such as disease reporting, without patient authorization, as a required public health activity.

A Patient Access Representative discovers that a coworker accessed a patient's records without a legitimate work reason. The BEST course of action is to:

Answer: Report the incident to the Privacy Officer or compliance department

Unauthorized access to PHI must be reported to the Privacy Officer or compliance department, as it constitutes a potential HIPAA violation requiring investigation and possibly breach notification.

Which of the following is required to be included in a HIPAA Notice of Privacy Practices (NPP)?

Answer: A description of the types of uses and disclosures the covered entity may make of PHI

The NPP must describe the types of uses and disclosures the entity may make, patient rights regarding their PHI, the entity's legal duties, and how to file a complaint.