HIPAA Lesson 5 Flashcards
A disclosure of PHI to the Office of Civil Rights for enforcement purposes is what kind of disclosure? o Permitted disclosure. o Internal disclosure. o Routine disclosure. o Required disclosure.
Required Disclosure
If a passerby overhears two doctors conferring about a patient, what kind of PHI disclosure would this be? o Incidental disclosure. o Required disclosure. o Nonroutine disclosure. o Routine disclosure.
Incidental Disclosure
Under what circumstances would the conditions of minimum necessary apply?
o Disclosure of PHI to the individual who is the subject of the information.
o Disclosure of PHI to a health care provider for treatment purposes.
o Disclosure of PHI within the workforce.
o Disclosure of PHI as a result of a signed authorization.
Disclosure of PHI within the workforce.
If a researcher with documented approval from an institutional review board requests PHI, which Privacy Rule provision would allow disclosure? o Reasonable effort. o Verification. o Reasonable reliance. o Minimum necessary.
Reasonable reliance.
When an individual is legally unable to exercise his or her own rights, who is authorized to make that person's health care decisions? o A physician. o A personal representative. o An executor. o The OCR.
A personal representative.
Does the Privacy Rule allow me to pick up a prescription for a friend? What if my friend wants me to go to the doctor with her?
The Privacy Rule allows both of these. If you take a friend or a family member with you to the doctor, the doctor can reasonably assume that he or she can talk to you about your healthcare in front of your friend. If your friend calls back later and asks the doctor a question about your appointment or your condition on your behalf, the doctor can share information with your friend because she was present at your appointment. However, the doctor wouldn’t be able to discuss other health matters or other conditions with your friend.
What two entities does the Privacy Rule require disclosure of PHI?
- The Patient
2. OCR
What is DRS?
Designated Record Set
What information is in a DRS?
- Medical and billing records
- Enrollment, payment, claims adjudication
- Health plan or healthcare provider records used to make healthcare decisions.
What information is not part of the DRS and does not have to be released to anyone for any reason?
Psychotherapy Notes
The OCR is granted rights to PHI to:
- Investigate Complaints
- Determine Compliance Status
- For Enforcement
The Privacy Rule permits some disclosures without ______ under certain circumstances
Authorization
Name two conditions in which disclosures are permitted without authorization.
- When state and other law requires the disclosure
2. When the disclosure meets certain conditions specified by the Privacy Rule.
List the permitted disclosures:
- TPO
- Limited marketing & fund-raising
- When required by law
- Public health activities
- Health oversight activities
- Victims of abuse, neglect, or domestic violence
- Court order or subpoena
- Limited law enforcement purposes
- Information about decedents to a coroner, medical examiner, or funeral director
- Organ, eye, or tissue donation from a cadaver
- Research, if approved by an institutional review board (an ethics committee that monitors experiments on people)
- Averting serious threat to health or safety
- Specialized government functions related to military, veterans, armed forces, correctional institutions, and custodial situations
- Government programs providing public benefits
- Workers’ compensation
_______ is always subject to minimum necessary requirements.
Disclosure
What type of disclosure requires a CE to first evaluate all workforce members’ need to access PHI and establish mechanisms to reasonably limit access to the specific PHI necessary for the job.
Internal Disclosures
________ disclosures are those that happen periodically. They often have specific known requirements, forms, and formats. Most covered entities’ ________ disclosures are for treatment, payment, and healthcare operations purposes.
Routine
What must be identified about routine disclosures in a covered entity’s policies and procedures?
- Purpose: Why does the covered entity need to share this information? (In this case, the patient’s school requires proof of immunization before a student can attend classes.).
- Amount and types: What information is the person or institution requesting? (The school wants to know which vaccinations and immunizations the covered entity provided and when.)
- Entity receiving: Who wants to know this information? (The child’s school has asked for this data.)
“The ______ establishes a voluntary reporting system designed to enhance the data available to assess and resolve patient safety and healthcare quality issues.
PSQIA of 2005
AHRQ
Agency for Healthcare Research and Quality
PSOs
Patient Safety Organizations
_______ disclosures are those that have little or no precedent. Or they are highly variable and require individual _______.
- Nonroutine
2. Evaluation
The Privacy Rule acknowledges that _______ disclosures might occur from time to time, which isn’t a violation of the Privacy Rule as long as the covered entities have reasonable _______ in place.
- Incidental
2. Safeguards
Disclosure for research purpose.
Permitted Disclosure
Disclosure of an individual’s own health records to that individual.
Required Disclosure
Disclosure that is overheard despite safeguards.
Incidental Disclosure
Disclosure within a CE’s workplace.
Internal Disclosure
Disclosure that happens periodically.
Routine Disclosure
Disclosure that has no precedence.
Non-routine Disclosure
_______ means whatever it takes, but just enough, to respond to the request.
Minimum Necesary
The minimum necessary provisions don’t apply in some cases. What are they?
- Disclosures to a healthcare provider for treatment purposes
- Disclosures to the individual who is the subject of the information
- Uses or disclosures made because of an authorization that an individual has signed
- Uses or disclosures required for compliance with the standardized HIPAA transactions (The information required to complete the standard transaction you learned about in Lesson 3 is the minimum necessary information.)
- Disclosures to the Office for Civil Rights (OCR) when it needs PHI to enforce the law
- Uses or disclosures required by other laws, like a subpoena or court order
What disclosure permits a covered entity to rely on the judgment of the party requesting the disclosure as to the minimum amount of information needed?
Reasonable Reliance
List the entities where a reasonable reliance disclosure is acceptable:
- A public official or agency for a disclosure permitted under the Privacy Rule or state law
- Another covered entity
- A professional who is a workforce member or business associate of the covered entity holding the information
- A researcher with appropriate documented approval from an institutional review board or a privacy board
The Privacy Rule also requires a covered entity to make _______ to limit its own uses of, disclosures of, and requests for PHI.
Reasonable Efforts
The Privacy Rule requires covered entities to _______ the identity and authority of anyone requesting PHI before disclosing the requested information.
Verify
A person authorized to act on behalf of the individual in making healthcare decisions is that person’s _______.
Personal Representative
A person with legal authority to make health care decisions on behalf of the individual (health care power of attorney, court-appointed legal guardian, general power of attorney)
An adult or emancipated minor
A parent, guardian, or other person acting in place of the parent (in loco parentis) with legal authority to make health care decisions on behalf of the minor child
An unemancipated minor
A person with legal authority to act on behalf of the deceased or the estate (executor of the estate, next of kin or other family member, durable power of attorney)
Deceased
List three circumstances in which the parent isn’t the personal representative for a minor child
- When state or other law doesn’t require the consent of a parent or other person before a minor can obtain a particular healthcare service, and the minor consents to the healthcare service (For instance, state law may allow an adolescent the right to obtain mental health treatment without parental consent.)
- When a court determines, or another law authorizes, someone other than the parent to make treatment decisions for a minor
- When a parent agrees to a confidential relationship between the minor and the physician (For example, a doctor asks the parent of a 16-year-old if the doctor can talk with the child confidentially about a medical condition, and the parent agrees.)
List three instances where a personal representative is not recognized.
- Abuse
- Neglect
- Endangerment
