HIPAA

Question 1

What Is Health Insurance Portability And Accountability Act (HIPAA)?

Answer 1

The Health Insurance Portability and Accountability Act (HIPAA) was originally passed in 1996. At the time, it was primarily intended to assist more Americans with obtaining health insurance coverage and to ensure that employees would not lose this coverage while they were changing jobs.

Soon, however, it became obvious that, with the advent of the internet and digital record-keeping, HIPAA would have to be amended multiple times to account for increasing privacy threats to patients’ private medical records.
HIPAA regulation today is a series of national standards concerning the security and privacy and confidentiality of protected health information.

Question 2

As of 2022, HIPAA rules to comply with are as follows:

Answer 2

HIPAA Privacy Rule
HIPAA Privacy Rule (finalized in 2003) sets standards for patient use and access to “protected health information” (PHI), demographic info used to identify the patient:

Name

Address

Any personal dates related to the individual (birth, death, admission, discharge, etc.)

Telephone number

Fax number

Email address

Social Security number

Medical record number

Health plan beneficiary number

Account number

Certificate/license number

Vehicle identifiers/serial numbers/license plate

Device identifiers/serial numbers

Web URLs

IP address

Biometric identifiers (e.g. fingerprints, voiceprints, retinal scans, etc.)

Full-face photos

Any other unique identifying numbers/codes/characteristics

Question 3

HIPAA Security Rule

Answer 3

The HIPAA Security Rule provides a set of safeguards to be instituted by all HIPAA-beholden entities, which involves administrative, technical, and physical standards for maintaining the security of PHI.

Question 4

HIPAA Breach Notification Rule

Answer 4

The HIPAA Breach Notification Rule sets standards for how data breaches are to be investigated, reported to the proper authorities, and communicated to affected patients.

A later piece of HITECH Act (2009), created a system of fines for violating HIPAA, elevating the potential costs for noncompliance with HIPAA to unprecedented heights.

Question 5

HIPAA Omnibus Rule

Answer 5

Effective in 2013, the HIPAA Omnibus Rule states that all business associates of involved healthcare entities must be HIPAA-compliant.

Considering all the adjustments made to HIPAA regulations so far, one can expect more HIPAA updates added in the future.

Question 6

Who Is Subject To HIPAA Law?

Answer 6

Legally, HIPAA law identifies two HIPAA-beholden categories: “covered entities” and “business associates”.

Covered Entities include:

Health Plans, e.g.: HMOs, health insurance companies, company health plans, and certain government programs like Medicare and Medicaid

The Majority of Health Care Providers: the healthcare providers that conduct business/store private information electronically (e.g. electronically billing health insurance)

Healthcare Clearinghouses: services that process nonstandard health information received from another entity into a standard (and vice versa)

Business Associates is a term that refers to any business associate of the above-specified covered entities in the form of a contractor, a subcontractor, or another person or company that is not an employee of the covered entity, such as:

Companies that help doctors get paid, billing companies, businesses that process healthcare claims

Companies that help administer health plans

External/independent professionals serving healthcare organizations, such as accountants, IT experts, attorneys, etc.

Question 7

Who Enforces HIPAA Compliance?

Answer 7

Enforcing HIPAA compliance is primarily the jurisdiction of the Department of Health and Human Services’ (HHR) Office for Civil Rights (OCR). The Center for Medicare and Medicaid Services (CMS) has certain limited powers of HIPAA enforcement; the Federal Communications Commission (FCC) and US Food and Drug Administration (FDA) had been involved in past legal HIPAA interventions.

Question 8

Q1: Updated HIPAA law must be complied with by:

1. Every American business regardless of industry
2. Covered entities and business associates in healthcare
3. All physicians but not registered nurses in hospitals and clinics
4. All US citizens and residents above the age of 18

Answer 8

2. Covered entities and business associates in healthcare

Question 9

Q2: Which of the following is NOT a patient right under HIPAA’s “Privacy Rule”?

1. Patient right to ask to see/get a copy of their health records
2. Patient right to have corrections added to their health information
3. Patient right to request that the healthcare entity issue them an in-depth technical report of the breach, if there is a breach
4. Patient right to be notified of how their health information is used/shared

Answer 9

3. Patient right to request that the healthcare entity issue them an in-depth technical report of the breach, if there is a breach

Question 10

Q3: The Notice of Privacy Practices must be:
1. Given to the patient to review on their first visit

2. Given to the patent to review on every visit
3. Provided to every individual entering the hospital/clinic waiting room, regardless of whether they are a patient or not
4. Posted online: no need to provide a physical copy in-person

Answer 10

1. Given to the patient to review on their first visit

Question 11

Q4: The “minimum necessary” rule refers to:

1. A minimal quota of patients to serve by a clinic within a calendar month
2. The understanding that healthcare employees must only look at patient’s PHI on as-needed basis
3. The minimum amount of days that must pass between changing company computer passwords
4. None of the above

Answer 11

2. The understanding that healthcare employees must only look at patient’s PHI on an as-needed basis

Question 12

Q5: If an employee perceives a PHI “privacy incident” that could result in a data breach, they are required to notify the Privacy Officer

1. True
2. False

Answer 12

1. True

Question 13

Q6: Once digital PHI record-keeping devices get old, they must be:

1. Thrown in the garbage
2. Taken to a proper state recycling center for computer hardware
3. Mailed to the patient (or their next of kin)
4. Accounted for and kept secure until they can be safely wiped/physically destroyed

Answer 13

4. Accounted for and kept secure until they can be safely wiped/physically destroyed

Question 14

Q7: What kind of protected health information is covered by HIPAA?

1. Electronic
2. Spoken
3. Paper
4. All of the above

Answer 14

4. All of the above

Question 15

Q8: Under HIPAA, it is permitted to access patient health files out of curiosity:

1. If you keep it to yourself
2. Under no circumstances – it is a HIPAA breach that could get you fired
3. If you know the patient very well
4. If the patient’s family was asking about it

Answer 15

2. Under no circumstances – it is a HIPAA breach that could get you fired.

Question 16

Q9: Computer security is:

1. A purely technical function
2. Exclusively the responsibility of the user
3. A combination of technical and user security measures and vigilance
4. Is not covered by HIPAA regulations

Answer 16

3. A combination of technical and user security measures and vigilance

Question 17

Q10: If a patient is being transferred to a different medical facility for specialized treatment, is it permissible to provide this facility with the patient’s PHI for the purposes of ensuring apt medical care to that patient?

1. Yes
2. No

Answer 17

1. Yes