PAR Regulatory Compliance & Health Privacy Laws 3 — Questions and Answers
Question 1: A patient is incapacitated in the ER. Under HIPAA, who may give permission to release PHI to family members present?
- Only a court-appointed guardian
- A licensed physician who determines it is in the patient's best interest (Correct answer)
- Any hospital administrator on duty
- Only the patient's attorney
Correct answer: A licensed physician who determines it is in the patient's best interest
When a patient is incapacitated, a licensed healthcare professional may use professional judgment to share PHI with family or friends involved in the patient's care if it is in the patient's best interest.
Question 2: What does the 'minimum necessary' standard under HIPAA require of Patient Access Representatives?
- Only requesting the minimum amount of payment from patients
- Limiting PHI disclosures to the smallest amount needed to accomplish the purpose (Correct answer)
- Maintaining the minimum number of records for regulatory compliance
- Providing patients with only the minimum information required by law
Correct answer: Limiting PHI disclosures to the smallest amount needed to accomplish the purpose
The minimum necessary standard requires that covered entities limit PHI uses and disclosures to the least amount needed to accomplish the intended purpose.
Question 3: Under the No Surprises Act, which of the following patients are protected from unexpected out-of-network bills?
- Only uninsured patients at in-network facilities
- Insured patients receiving emergency care or non-emergency care at in-network facilities from out-of-network providers (Correct answer)
- Only Medicare and Medicaid patients
- Patients who signed an advance consent form for out-of-network services
Correct answer: Insured patients receiving emergency care or non-emergency care at in-network facilities from out-of-network providers
The No Surprises Act protects insured patients from surprise bills for emergency services and for non-emergency services at in-network facilities from out-of-network providers without prior consent.
Question 4: A patient verbally requests that information about their visit not be shared with their spouse. Under HIPAA, the facility must:
- Comply with the request only if the patient submits it in writing
- Honor the restriction if it does not interfere with the patient's treatment (Correct answer)
- Inform the spouse of the restriction before honoring it
- Deny the request if the spouse is listed as an emergency contact
Correct answer: Honor the restriction if it does not interfere with the patient's treatment
Patients have the right to request restrictions on PHI disclosures, and while facilities are not required to agree to all restrictions, they must honor any restriction agreed upon.
Question 5: Which CMS Condition of Participation requires hospitals to inform patients of their rights before or at the point of admission?
- The Patients' Bill of Rights
- The Patient Rights CoP (42 CFR 482.13) (Correct answer)
- The HIPAA Notice of Privacy Practices requirement
- The Joint Commission Patient Education Standard
Correct answer: The Patient Rights CoP (42 CFR 482.13)
The CMS Patient Rights Condition of Participation (42 CFR 482.13) requires hospitals to inform each patient of their rights before or at admission.
Question 6: Under HIPAA's Right of Access rule, what is the maximum fee a covered entity can charge for providing medical records in electronic format to the patient?
- No fee may be charged for electronic records
- A reasonable cost-based fee covering labor, supplies, and postage only
- A flat fee not to exceed $6.50 when records are provided electronically (Correct answer)
- The same fee charged to third parties requesting records
Correct answer: A flat fee not to exceed $6.50 when records are provided electronically
OCR guidance allows a flat fee of no more than $6.50 for electronic copies of PHI provided directly to the patient, as an alternative to calculating actual costs.
Question 7: A breach notification under HIPAA must be sent to affected individuals within how many days of discovering the breach?
- 30 days
- 45 days
- 60 days (Correct answer)
- 90 days
Correct answer: 60 days
HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach.
PAR Regulatory Compliance & Health Privacy Laws 3
A patient is incapacitated in the ER.
Under HIPAA, who may give permission to release PHI to family members present?