HIPAA Privacy - Ccma

1. Which HIPAA rule focuses on safeguards for ePHI (administrative, physical, technical)?

   HIPAA Security Rule. The Security Rule mandates protections to guard ePHI against threats and unauthorized access.

2. What is ePHI under HIPAA?

   PHI created, stored, transmitted, or received electronically. ePHI requires specific security measures to ensure confidentiality, integrity, and availability under the HIPAA Security Rule.

3. Which HIPAA right allows a patient to see certain non-routine disclosures of PHI?

   Right to an accounting of disclosures. Accounting tracks disclosures to promote transparency and allow patients to monitor PHI access.

4. What is the HIPAA minimum necessary standard?

   Use or disclose only the least PHI needed for the purpose. This standard limits PHI access to the minimum required to accomplish the intended purpose, reducing privacy risks.

5. Find the HIPAA error: fax PHI without a cover sheet that warns of confidentiality.

   Error: send PHI fax without a confidentiality cover sheet. Cover sheets alert recipients to confidentiality, reducing risks of mishandling sensitive PHI.

6. Which action is correct for ROI: release the entire chart when only labs were requested?

   Incorrect; release only the requested labs (minimum necessary). The minimum necessary rule requires limiting disclosures to only what's requested, protecting privacy.

7. Which HIPAA permission is used for TPO disclosures: consent or authorization?

   Consent is not required; authorization is not required for TPO. TPO activities are permitted without patient permission to facilitate routine health care functions efficiently.

8. What is the patient right to access under HIPAA?

   Right to inspect or obtain a copy of their PHI in the designated record set. This right enables patients to review and manage their health information for accuracy and transparency.

9. What is an Authorization under HIPAA release-of-information procedures?

   Written permission for a specific disclosure not otherwise permitted. Authorizations provide explicit patient permission for PHI disclosures outside permitted categories like TPO.

10. What does TPO stand for in HIPAA permitted uses and disclosures?

    Treatment, Payment, and Health Care Operations. TPO encompasses essential functions allowing PHI use without authorization to support health care delivery.

11. Which HIPAA rule sets standards for uses and disclosures of PHI?

    HIPAA Privacy Rule. The Privacy Rule regulates how covered entities handle PHI to protect patient privacy rights.

12. Identify the HIPAA-compliant action: verify identity before releasing PHI by phone, yes or no?

    Yes, identity and authority must be verified before disclosure. Verification prevents unauthorized disclosures, upholding patient privacy and HIPAA compliance.

13. Which HIPAA document explains patient rights and routine uses of PHI at a facility?

    Notice of Privacy Practices (NPP). The NPP informs patients of their HIPAA rights and the entity's privacy practices for PHI handling.

14. What is the required patient action for the NPP in most outpatient settings?

    Acknowledge receipt of the NPP (signature or documented refusal). Acknowledgment confirms patient receipt and awareness, though it does not constitute consent for PHI use.

15. Which HIPAA right allows a patient to request changes to an incorrect record entry?

    Right to request an amendment. Amendments allow corrections to errors, maintaining the integrity of patient health records.

16. What must a HIPAA Authorization include regarding time limits?

    An expiration date or expiration event. Time limits prevent indefinite permissions, safeguarding ongoing patient privacy rights.

17. What must a HIPAA Authorization include regarding the signer?

    Signature of patient or personal representative and date. This verifies the authorizing individual's identity and intent, ensuring validity of the permission.

18. Identify the correct ROI step before sending records to an outside attorney.

    Obtain a valid, signed HIPAA Authorization (or other legal authority). Authorization or legal basis ensures disclosures are permitted and documented under HIPAA rules.

19. What does HIPAA stand for in United States health care privacy law?

    Health Insurance Portability and Accountability Act. This federal law, enacted in 1996, establishes standards for protecting sensitive patient health information from unauthorized disclosure.

20. What agreement must exist before a Business Associate can handle PHI?

    A Business Associate Agreement (BAA). The BAA outlines responsibilities for safeguarding PHI, ensuring compliance with HIPAA standards.

21. Which disclosures are exempt from the minimum necessary standard: treatment, payment, or operations?

    Treatment disclosures. Treatment disclosures are exempt to allow full information sharing necessary for effective patient care.

22. Which option best protects HIPAA privacy: discuss a patient in an elevator or in a private room?

    Discuss only in a private room or other secure area. Secure areas minimize risks of incidental disclosures, complying with HIPAA privacy safeguards.

Study these flashcards