Healthcare/Medical Flashcards
Why was the Health Insurance Portability and Accountability Act of 1996 (HIPAA) enacted?
To improve the efficiency of healthcare delivery. It also shifted reimbursement of federal healthcare payments from Medicare and Medicaid to an electronic format, which increased the need to protect the privacy and security of healthcare information.
Who enforces HIPAA? What are the possible penalties?
Enforcement of HIPAA regulations is the responsibility of the Department of Health and Human Services, which, as of 2020, can levy fines of up to $1.8 million. Civil penalties increase annually to reflect inflation and more egregious violations may result in jail time of up to 10 years.
Does HIPAA preempt stricter state laws?
No, HIPAA does not preempt stricter state laws.
What are the requirements of the HIPAA privacy rule?
PRIVACY NOTICE UP FRONT: The Privacy Rule requires a covered entity to provide a detailed privacy notice at the date of first service delivery.
OPT-IN, LIMITED USE AND DISCLOSURE, ACCESS AND AMENDMENT: The rule also requires opt-in authorization for use or disclosure of PHI outside of HIPAA guidelines; it limits the use and disclosure of protected health information for business associates and it provides information on how individuals can access and amend their PHI.
SAFEGUARDS, PRIVACY OFFICIAL: Covered entities must also have safeguards in place to protect the confidentiality and integrity of all PHI and designate a privacy official to develop and implement privacy protections.
What are the requirements of the HIPAA security rule?
REASONABLE LEVEL OF SECURITY: To ensure the confidentiality, integrity and availability of ePHI, the Security Rule requires a reasonable level of security to protect against anticipated threats and hazards, and unauthorized use or disclosure of ePHI.
SECURITY/RISK ASSESSMENT PROGRAM: It further establishes that a designated person must implement and oversee a security and training program, as well as conduct ongoing assessment of risk.
EXCEPTIONS: The Security Rule does not apply to PHI transmitted orally or in writing.
What are some common concerns with the use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates?
- Invasiveness of the technology, data minimization efforts, the collection and possible exposure of sensitive information and reidentification of infected individuals
- Contact tracing apps should minimize the amount of data they are collecting, protect the data, use any personal information collected for the sole purpose of contact tracing and destroy the data as soon as the purpose has been fulfilled
What did the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 accomplish?
- HITECH promoted the adoption and meaningful use of health information technology and offered incentives for healthcare providers to use and develop electronic health records and a national electronic health information exchange.
- HITECH strengthened existing HIPAA laws through data minimization, increased penalties and notice of breach.
What are the policy goals of the 21st Century Cures Act of 2016?
The 21st Century Cures Act expedites the research process for new medical devices and prescription drugs, quickens the process for drug approval and reforms mental health treatment.
What is the Confidentiality of Substance Use Disorder Patient Records Rule (42 CFR Part 2)?
- The Confidentiality of Substance Use Disorder Patient Records Rule provides privacy protections for people seeking medical care for alcohol and substance abuse.
- The scope of the Confidentiality of Substance Use Disorder Patient Records Rule includes restricting the use of information that could lead to criminal charges.
The Rule also prohibits the re-disclosing of information if it would identify the individual as receiving treatment.
What are the exceptions to the consent requirements of 42 CFR Part 2?
- Exceptions to consent requirements of the Confidentiality of Substance Use Disorder Patient Records Rule include emergencies, research, evaluations, crimes on premises or against personnel, child abuse reporting, and court orders.
What is a covered entity under HIPAA?
“Covered entities” are entities that must comply with HIPAA’s requirements to protect the privacy and security of health information and provide individuals with certain rights related to their health information.
They include health plans (such as health insurance companies, HMOs, company health plans, and Medicare/Medicaid),
healthcare clearinghouses (such as billing services or healthcare management information systems), and
healthcare providers who electronically transmit health information.
What is a business associate under HIPAA?
Any person or organization, other than a member of a covered entity’s workforce, that performs services and activities for or on behalf of a covered entity if such services and activities involve the use or disclosure of PHI.
Services and activities include things such as claims processing, data analysis, utilization review and billing, as well as legal, actuarial, accounting, consulting, data aggregation, management, administration, accreditation and/or financial services.
What is Protected Health Information?
Protected health information (or PHI) is any individually identifiable health information transmitted or maintained in any form or medium that relates to an individual’s past, present, or future physical or mental health or condition; the provision of healthcare to an individual; or the past, present, or future payment for the provision of healthcare to the individual.
Do covered entities and business associates have to meet the same standards under HIPAA?
Yes. Where a covered entity uses a business associate to help with data processing, the covered entity must have a written agreement or other arrangement that states specifically what the business associate has been engaged to do and requires them to comply with the Privacy Rule’s privacy and security standards.
What is GINA?
GINA was created to protect individuals against genetic discrimination by health insurance providers (Title I) and employers (Title II)
- Title I prohibits insurance providers from implementing higher premiums based on genetic tests
- Title II prohibits employment discrimination based on genetic information, including unions and training programs, family members who have manifested a disease, and requirements or requests for genetic information
- GINA creates national limits on the use of genetic information in health insurance and employment
- Does not preempt stricter state laws
- GINA directs the secretary of HHA to revise HIPAA regulations to include genetic information in the definition of PHI
