Legal Compliance - Ccma

1. Which HIPAA rule requires safeguards for electronic PHI (ePHI)?

   HIPAA Security Rule. The Security Rule mandates administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and security of ePHI.

2. Identify the correct action: A coworker asks about a neighbor's visit; you are not involved in care.

   Do not disclose; it is an unauthorized access/disclosure of PHI. HIPAA prohibits disclosing PHI without authorization or a valid need-to-know basis to prevent privacy violations.

3. What is the Controlled Substances Act (CSA) purpose?

   Regulates controlled drugs by scheduling and legal controls. The CSA classifies drugs into five schedules based on abuse potential and medical use to control their manufacture and distribution.

4. Which HIPAA concept allows sharing PHI with family involved in care when the patient agrees or does not object?

   Informal permission using professional judgment. HIPAA permits sharing relevant PHI with family or friends involved in care based on the patient's informal permission or lack of objection.

5. What does ACA stand for in United States health care law?

   Affordable Care Act. The ACA, enacted in 2010, aims to expand health insurance coverage and improve health care affordability in the US.

6. What is a reportable HIPAA breach in general terms?

   Impermissible use or disclosure compromising PHI privacy or security. A breach occurs when unsecured PHI is accessed or disclosed in a way that poses significant risk of harm to the individual.

7. Which CSA schedule has high abuse potential and no accepted medical use federally?

   Schedule I. Schedule I drugs are deemed to have no accepted medical use and high potential for abuse under federal law.

8. What is the minimum necessary standard under the HIPAA Privacy Rule?

   Use or disclose only the least PHI needed for the task. This standard requires covered entities to limit PHI access and disclosure to the minimum necessary to accomplish the intended purpose.

9. Which HIPAA rule sets standards for using and disclosing PHI?

   HIPAA Privacy Rule. The Privacy Rule establishes national standards to protect individuals' medical records and other personal health information.

10. What is a business associate under HIPAA?

    Vendor handling PHI for a covered entity under a contract. Business associates perform functions involving PHI on behalf of covered entities and must comply with HIPAA requirements.

11. Which agreement must be in place before a vendor can access PHI for services?

    Business Associate Agreement (BAA). A BAA contractually ensures that business associates safeguard PHI in accordance with HIPAA standards.

12. Identify the best immediate step after discovering an email with PHI sent to the wrong recipient.

    Report the incident immediately per policy to the privacy/security officer. Immediate reporting allows the organization to assess the incident, mitigate harm, and comply with breach notification requirements.

13. What document informs patients about PHI uses, disclosures, and rights?

    Notice of Privacy Practices (NPP). The NPP must be provided to patients to explain how their PHI may be used and their rights under HIPAA.

14. What is the HIPAA right to an accounting of disclosures?

    Right to a list of certain non-TPO disclosures of PHI. This right requires covered entities to provide a list of disclosures made over the prior six years, excluding TPO.

15. Which ACA provision requires most private health plans to cover preventive services without cost-sharing?

    Coverage of USPSTF-recommended preventive services without cost-sharing. This ACA requirement ensures access to evidence-based preventive care, such as screenings and vaccinations, at no out-of-pocket cost.

16. Which three purposes allow PHI use or disclosure without patient authorization?

    Treatment, payment, and health care operations (TPO). TPO permits covered entities to use and disclose PHI without authorization for essential functions related to patient care and administration.

17. Which type of communication is generally permitted without authorization: appointment reminders or marketing?

    Appointment reminders (health care operations). Appointment reminders fall under health care operations, allowing disclosure without authorization, unlike marketing which requires it.

18. Identify the correct response to a request to change a Schedule II prescription over the phone.

    Do not alter it; refer to prescriber per policy and legal requirements. Schedule II prescriptions cannot be altered or refilled over the phone due to strict DEA regulations to prevent abuse.

19. What does HIPAA stand for?

    Health Insurance Portability and Accountability Act. HIPAA, enacted in 1996, establishes national standards for protecting sensitive patient health information from unauthorized disclosure.

20. Which patient right allows obtaining a copy of their medical record in a set timeframe?

    Right of access to PHI. Patients have the right to inspect and obtain copies of their PHI within 30 days of request, with limited exceptions.

21. What is a HIPAA covered entity?

    Health plan, health care clearinghouse, or certain providers. Covered entities are organizations subject to HIPAA that handle PHI in connection with health care transactions.

22. What is the HIPAA right to request an amendment?

    Right to request correction of PHI in the designated record set. Patients can request amendments to inaccurate or incomplete PHI, and covered entities must respond within 60 days.

23. Which law strengthened HIPAA enforcement and expanded breach notification requirements?

    HITECH Act. HITECH enhances HIPAA by imposing stricter penalties for violations and requiring notification for breaches affecting 500 or more individuals.

24. What does HITECH stand for?

    Health Information Technology for Economic and Clinical Health Act. HITECH, part of the 2009 stimulus package, promotes the adoption and meaningful use of health information technology.

Study these flashcards