RHIT Release of Information and Privacy Practices 3

Question 1

Under HIPAA, what is a Business Associate Agreement (BAA)?

Accepted Answer

A written contract ensuring vendors who access PHI protect it in accordance with HIPAA

Answer

A contract between a hospital and its physicians

Answer

An agreement between patients and their insurance company

Answer

A policy governing employee use of the EHR

Question 2

What fees may a covered entity charge for releasing records to a patient?

Accepted Answer

Only a reasonable, cost-based fee including labor, supplies, and postage

Answer

Any amount determined by the billing department

Answer

A flat fee of $50 per request regardless of volume

Answer

No fees are permitted under any circumstances

Question 3

When releasing records for legal purposes such as litigation, which best practice protects the facility?

Accepted Answer

Document every step of the release process and retain copies of authorizations and release logs

Answer

Release all records as quickly as possible to avoid delays

Answer

Only release records if both parties agree verbally

Answer

Destroy records after releasing copies to prevent further requests

Question 4

What is the retention requirement for adult patient records under most U.S. state laws?

Accepted Answer

A minimum of 5 to 10 years, varying by state law

Answer

1 year after the last date of service

Answer

Indefinitely, with no destruction permitted

Answer

3 years from the date of admission

Question 5

A covered entity discovers that a laptop containing unencrypted PHI was stolen. What is the required action under HIPAA?

Accepted Answer

Conduct a breach risk assessment and notify affected individuals, HHS, and possibly the media if required

Answer

Report the breach only if it affected more than 10,000 patients

Answer

Purchase new laptops and take no further action

Answer

Delete all digital records to prevent further exposure

Question 6

Which of the following best describes the concept of 'de-identification' under HIPAA?

Accepted Answer

Removing 18 specified identifiers so the information cannot identify an individual

Answer

Encrypting records before sharing with business associates

Answer

Requiring patient authorization before all disclosures

Answer

Limiting record access to treating physicians only