Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Law > HIPAA > Flashcards

HIPAA Flashcards

You may prefer our related Brainscape-certified flashcards:
Civil Procedure 1L flashcards MBE flashcards MPRE flashcards
1
Q

Who must follow HIPAA?

A

HIPAA applies to “covered entities” which include:

1) Health Plans – health insurance companies, HMOs, company health plans, government health care programs like Medicare, Medicaid, military and veterans health care programs

2) Data Clearinghouses – entities that process non standardized health information they receive from other entities into a standard format (e.g. middleman between providers and health plans, etc.)

3) Health Care Providers – physicians, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies – only affects providers who transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Who must follow HIPAA?
– In addition to “covered entities,” HIPAA also applies to…

A

“business associates”

An entity or person who performs functions or activities involving the use or disclosure of protected health information on behalf of or providing services to a covered entity

Examples: third party administrators assisting health plans with claims processing, attorneys, CPA firms and accountants, medical transcriptionists, pharmacy benefits managers,

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

HIPAA applies to “covered entities” which include:

A
  1. Health Plans
  2. Clearinghouses
  3. Health Care Providers including pharmacist
  4. Business Associate who assist covered entities with provision of health care
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Protected Heath Information (PHI)

A

Information protected under HIPAA

Includes all heath care information related to patients health/condition, treatment/ care, payment and any information that identifies or could be reasonably expected to identify the patient

-

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Examples of Protected Health Information

A

Names and address
Dates (birth, admit/discharge, death)
Phone/fax numbers
Email address
Social security number
Medical record number
Health plan beneficiary number
Account numbers
Certificate/license numbers
VIN vehicle identification numbers and serial numbers, license plate numbers URL address
IP address
Device identifiers
Biometric identifiers (finger prints, voice print)
Full face photos/images
Any other unique identifying numbers, characteristics or code

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

HIPAA is a establishment of national standards for

A
  • electronic health care transactions and national provider identifier (NPI) number
  • rules on security and privacy of heath care information
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

security

A

protects information (confidentially and availability)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Privacy

A

patients right and how their information may be used

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Health Information Technology for Economic and Clinical Health Act (HITECH)

A
  • amends HiPPA
  • requires breach notification
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How is PHI defined in 45 CFR 160.103

A
  • individually identifiable health information
  • transmitted or maintained by electric media or in any form or medium
  • by a covered entity or business associate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How must pharmacies provide notice of privacy practices ?

A
  • in paper on the first day patient uses the pharmacy (must be sent electronically)
  • Posted in a prominent location in the pharmacy and provided if requested by any person ( not limited to patients)
  • on the pharmacy’s website
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Knowledge of Notice

A
  • must acquire written acknowledgment from the patient that they received the information
  • one acknowledgment per persons, once!
  • allowed to refuse to sign and pharmacy cannot refuse to serve ( document a good faith effort)
  • signatures kept in logbook
  • may mail notice to pt and request it sent back
  • can be sent electronically
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Is it a violation if pharmacy made a good faith effort for acknowledgment from patient and documented they tried?

A

It is not considered a violation as long as the pharmacy tried to obtain it and documented that they tried

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

who are able to sign for the patient acknowledgment ?

A
  • personal representatives (parent-child, legal guardian, power of attorney)
  • others may pick up prescriptions, but not permitted to sign the acknowledgment if they are not personal representatives
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Do Children under 18 have to sign the acknowledgment?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

how long should records of signatures for acknowledgment be kept

A

6 years from date signed or from the date the last prescription for the ration was dispensed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When should pharmacy employees use or disclose health information

A

for treatment, payment, regular health care operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

How much PHI can the Pharmacy Disclose?

A
  • “minimum necessary amount”
  • the amount needed to carry out the service you are engaging in for the patient
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are exceptions where pharmacist may disclose a PHI ?

A
  • communication to the patient
  • communication with other health care providers treating the patient
  • if patient authorizes disclosure
  • as required by HHS to determine compliance and enforce HIPAA
  • if required by law
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

When are incidental disclosures are permitted ?

A
  • they couldn’t be reasonably prevented
  • are limited in nature
  • unintended byproduct of a permitted disclosure
21
Q
A
22
Q

Pharmacists not liable for incidental disclosures if they have “reasonable safeguards” in place. Who are reasonable safeguards?

A
  • administrative
  • technical
  • physical

ex:Patients in waiting area may overhear pharmacist counseling another patient

23
Q

is it a violation to call out patients name if they are waiting for a prescription ?

A

No

24
Q

Can a pharmacist leave a phone message to the patient ?

A

yes, but must be careful about what they disclose; limit to only minimum necessary informations

do not use the name of the medication

24
Q

Privacy rule permits use and disclosure of protected health information without the patients permission

A
  • serious threats to health or safety
  • public health activities
  • exposed to a communicable disease or at risk of contracting or spreading the disease or condition
  • employers concerning information on work related illness to comply with OSHA
  • school reporting proof of immunization of students required by state
  • victims of abuse
  • judicial and administrative proceedings
  • law enforcement and specialized military purposes
  • research purposes
  • decedents
  • tissue donations
  • workers’ compensation benefit programs
25
Q

Covered entities are required to develop reasonable policies and procedures for PHI disposal. How should PHI be disposed ?

A
  • shred or burn paper with PHI
  • using opaque bags in secured location prior to pickup
  • clearing/ destroying electronic information
26
Q

Breach notification is required if analysis shows a breach. How must a PH breach be notified?

A
  • Affected individuals must be notified “ without reasonable delay” but within 60 days of discovery
  • If less than 500 individuals affected, pharmacy must notify HHS within 60 day of discovery
  • If more than 500 individuals affected, pharmacy must notify media with 60 days and and HHS immediately
27
Q

what are exceptions to maketing PHI restrictions ?

A
  • communications by a covered entity about its own products or services
  • communications made for treatment of the individual
  • communications made for case management/care coordination or recommendations on alternative treatments and health care providers
28
Q

Refill reminder exceptions (marketing and PHI)

A
  • communication must be about a currently prescribes drug or biologic
  • communication involves financial remuneration that is reasonably related to the covered entity’s cost of making the communication
29
Q

What examples DO fall under the refill reminder exception (marketing and PHI) ?

A
  • refill reminder
  • communications about generic equivalents of a drug being prescribed
  • communications about recently lapsed prescription (within the last 90 days)
  • adherence communications
30
Q

What examples DO NOT fall under the refill reminder exception (marketing and PHI) ?

A
  • specific new formulations of a currently prescribed medication
  • specific adjunctive drugs related to the currently prescribes medication
  • encouraging an individual to switch from a prescribed medicaticine to alternative medicine
31
Q

Must all pharmacy employees be trained regarding HIPAA?

A

Yes.. Document completion of training

Must also notify patient of their privacy rights and how there information can be used. (public notices must be publicly available)

32
Q

Cures Act

A

encourages access and exchange of PHI to appropriate parties
-sharing info with friends and family
-research
-mental health

33
Q

What may be done by a health provider if a patient is not present or incapacitated?

A

a health provider may share the patient information with family, friends, or others involved in the patients care to payment of care

as long as the health care provider determines, based on professional judgment, that doing so is in the best interest of the patient

34
Q

When a patient is not present or unable to agree or object to disclose due to incapacity or emergency circumstances what is the health care provider permitted to do ?

A

determine whether disclosing a patient’s information to the patient’s family, friends, or other persons involved in the patient’s care or payment for care, is in the best interests of the patient

  • disclose only the PHI that is directly relevant to the person’s involvement in the patient’s care or payment for care
35
Q

If the patient is present and has the capacity to make health care decisions, can the healthcare provider discuss the patient’s health information with the patient’s family, friends, or others involved in the patient’s care or payment for care?

A

yes , if the patient agrees or given the opportunity, doesn’t object

36
Q

HIPPA does not require that a health care provider document the patients agreement or lack of objection but?

A

a provider may choose to document a patients agreement to share information with a family, friend or other person in writing

37
Q

How may a patients health information be shared with a friend, family member or other person?

A

face to face, over the phone, or in writing

38
Q

Does HIPAA require proof of identity, if the the caller states that he or she is a family member or friend of the patient ?

A

no , must be reasonably sure

39
Q

If a patient brings a family member along as an interpreter, can you disclose the information to this family member?

A

YES, if the patient agrees, or does not object, or you determine in your professional judgment, that the patient does not object

40
Q

HIPAA allows covered health care providers to share a patient’s health information with an interpreter without the patient’s written authorization under the following circumstances:

A
  • employee interpreters
  • contracted phone service interpreters
  • family member interpreters
41
Q

A patient with severe mental illness has stopped taking a prescribed medication. Can the provider tell the patient’s family members?

A

If patient doesn’t object, yes

If patient lacks capacity in provider’s professional judgment and sharing would be in best interest of patient, the provider may tell a family member and can only disclose necessary information

Cannot share if patient has capacity and objects, unless the provider has a good faith belief the patient poses a threat to the health or safety of the patient or others and the family member is reasonably able to prevent or lessen that threat

42
Q

a health care provider is permitted to share patient information with a patient’s personal representative under the Privacy Rule unless there is an exception. What is the exception?

A
  • State law doesn’t require parental consent for a particular health service and the child consents to treatment and doesn’t request a parent be treated as a personal representative
  • Parent agrees to confidential relationship between provider and child
  • Provider believes there are safety concerns (violence, abuse, or neglect) and in their professional judgment it is not in the best interest of the patient to treat the parent as a personal representative
43
Q

What does the Privacy Rule permit in response to a law enforcement official’s request ?

A

a HIPAA covered entity, such as a hospital, to disclose certain protected health information, including the date and time of admission and discharg for the purpose of locating or identifying a suspect, fugitive, material witness, or missing person

44
Q

Does provider have a duty to warn family or law enforcement that a patient might hurt themselves?

A

The mental healthcare providers’ “duty to warn” is based off of the Tarasoff v. Regents of University of California case (guy threats to kill ex gf)

Florida law allows mental health professionals to disclose patient communications necessary to warn potential victims or communicate the threat to law enforcement if the patients has made an actual threat to physically harm a victim and the professional makes a clinical judgment that the patient has an apparent capability to commit this act and it is more likely than not that they will carry it out in the near future.

45
Q

Notifying family, friends, or caregivers about a patient’s overdose from opioid misuse? May notify family, friends, or caregivers (FFC) if:

A
  • Patient was given opportunity to object and doesn’t object
  • The FCC have been involved in patients care or payment for care and patient has not objected
  • Professional judgement of provider that its in the best interest of patient if patient is incapacitated
  • Notification is necessary to prevent serious or imminent threat to health or safety of patients or others
  • Can notify using professional judgment due to patient unavailablity in an emergency situation
  • If patient is deceased, may disclose info to FFC indecent stated preferences not to disclose at some point prior to their death
46
Q

What are the HIPAA Security Rule guidelines in telemedicine ?

A

-Only authorized users should have access to ePHI

– A system of secure communication should be implemented to protect the integrity of ePHI

– A system of monitoring communications containing ePHI should be implemented to prevent accidental or malicious breaches

47
Q

Health care providers should perform a security risk assessment when choosing a technology provider and use technology that has:

A

full encrypted data

peer to peer secure network connection

must address storage of video/ obtain system that does not store it on their server or of the do they are protected

the technology provider should be willing to enter into a business associate agreement (BAA) with the health care provider

48
Q
A

Law (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions