RHIT Release of Information and Privacy Practices

Question 1

Which federal regulation primarily governs the release of patient health information by covered entities?

Accepted Answer

The HIPAA Privacy Rule

Answer

The False Claims Act

Answer

The HITECH Act

Answer

The Stark Law

Question 2

A patient requests access to their own medical records. Under HIPAA, the covered entity must provide access within:

Accepted Answer

30 calendar days, with one possible 30-day extension

Answer

7 calendar days

Answer

60 calendar days

Answer

10 business days

Question 3

Which of the following is NOT required on a valid HIPAA-compliant authorization form for release of information?

Accepted Answer

The patient's insurance policy number

Answer

A description of the information to be used or disclosed

Answer

An expiration date or event

Answer

The purpose of the disclosure

Question 4

Under HIPAA, which of the following disclosures does NOT require patient authorization?

Accepted Answer

Disclosure for treatment, payment, and healthcare operations (TPO)

Answer

Disclosure to the patient's employer

Answer

Disclosure to a marketing company

Answer

Disclosure to the patient's attorney

Question 5

What is the 'minimum necessary' standard under HIPAA?

Accepted Answer

Covered entities must disclose the minimum amount of PHI needed to accomplish the intended purpose

Answer

Covered entities must always share complete records with requesting parties

Answer

Patients may only request a minimum of five pages of records

Answer

Records must be redacted to one page before release

Question 6

A hospital receives a subpoena for patient records without a court order. What is the appropriate response?

Accepted Answer

Review the subpoena and follow applicable state law and HIPAA requirements before releasing

Answer

Release records immediately without review

Answer

Deny all subpoenas without exception

Answer

Release only billing records, not clinical records