RHIT Release of Information and Privacy Practices 3

Question 1

Under HIPAA, what is a Business Associate Agreement (BAA)?

Accepted Answer

A written contract ensuring vendors who access PHI protect it in accordance with HIPAA

Answer

A BAA is a required contract between a covered entity and a business associate that establishes the permitted uses and required safeguards for PHI the associate handles.

Question 2

What fees may a covered entity charge for releasing records to a patient?

Accepted Answer

Only a reasonable, cost-based fee including labor, supplies, and postage

Answer

HIPAA and the HITECH Act permit covered entities to charge only reasonable, cost-based fees for providing copies of PHI, which may include labor, supplies, and postage.

Question 3

When releasing records for legal purposes such as litigation, which best practice protects the facility?

Accepted Answer

Document every step of the release process and retain copies of authorizations and release logs

Answer

Thorough documentation of the ROI process—including authorizations, release logs, and staff attestations—protects the facility during legal disputes or audits.

Question 4

What is the retention requirement for adult patient records under most U.S. state laws?

Accepted Answer

A minimum of 5 to 10 years, varying by state law

Answer

Most states require retention of adult medical records for a minimum of 5 to 10 years, though specific requirements vary; facilities must follow the more stringent of state or federal requirements.

Question 5

A covered entity discovers that a laptop containing unencrypted PHI was stolen. What is the required action under HIPAA?

Accepted Answer

Conduct a breach risk assessment and notify affected individuals, HHS, and possibly the media if required

Answer

Under the HIPAA Breach Notification Rule, covered entities must conduct a risk assessment and, if a breach is confirmed, notify affected individuals, HHS, and potentially the media for large breaches.

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Practice Test

RHIT Release of Information and Privacy Practices 3