Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Aspects of Health Law > HIPAA Privacy Rule > Flashcards

HIPAA Privacy Rule Flashcards

1
Q

HIPAA acronym

A

Health Insurance Portability and Accountability Act

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Privacy Rule was passed in what year?

A

2003

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Security Rule was passed in what year?

A

2005

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

The privacy rule establishes the ______

A

minimum

(NOTE: if state and federal are diff, follow the most stringent one)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is privacy?

A

Freedom from unauthorized intrusion

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is confidentiality?

A

requires HC providers to protect heath records from unauthorized use

(NOTE: may be written or verbal)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What title # of HIPAA pertains to privacy and security?

A

Title II

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What forms of info does the Privacy rule cover?

A

oral, written, and electronic

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What forms of info does the Security rule cover?

A

Only electronic info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

PHI acronym

A

Protected health info

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What does HIPAA lack?

A

a private right of action

(NOTE: means that a pt can’t sue for HIPAA violation, only an attorney or general gov)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Purpose of HITECH (2009) (2)

A
  • Strengthens privacy and security of PHI (i.e. use of EHRs)
  • increased penalties
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is health info per HIPAA?

A

Any info (whether oral or recorded in any form) that is created or received by a health care provider, health plan, employer, life insurer, school

AND relates to the past, present, or future phys/mental health of an individual

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What happens if health info is not dated?

A

Applies to the future

(no end date)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What 6 things does HIPAA provide the patient the right of?

A
  1. access
  2. request amendment
  3. accounting of disclosure
  4. request confidential communications
  5. request restrictions
  6. complain of privacy rule violations
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Who does HIPAA apply to? (2)

A
  1. Covered entities (+ workforces)
  2. Business associates (+ workforce and subcontractors)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is covered under HIPAA?

A

PHI (and any “HIPAA identifiers” that point to a certain pt)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is NOT covered under HIPAA? (2)

A
  • De-identifiied info
  • personnel and edu records
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Three HIPAA CEs:

A
  • Healthcare provider
  • Health plan
  • Healthcare clearinghouse
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

CE: Healthcare provider description

A

doctor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

CE: Health plan description

A

insurance plan

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

CE: Healthcare Clearinghouse description

A

3rd party billing vendor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Should HIPAA be politicalized?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

An example of an organization that would need a business associate agreement is…

a) housekeeping service
b) Hospital where dr refers patients for surgery
c) Healthcare organization’s employees
d) Billing service that the healthcare organization uses

A

d) Billing service that the healthcare organization uses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

HIPAA Applicability: What is a Business Associate (BA)?

A

Any person or org that provides services around PHI or its disclosure

(ex: 3rd party vendors, consultants, etc)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is a Business associate agreement (BAA)? Does it apply to subcontractors?

A

Legally protects info handled by BA that complies with HIPAA

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Components of a BAA (3):

A
  • written
  • specifies permitted/prohibited uses
  • assurances of safeguards to prevent unauthorized use
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What law added more BA categories?

A

HITECH

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

If a health care facility accepts cash or provides free services, like a clinic that provides physical exams, administers vaccines, and gives well baby check-ups regulated by HIPAA?

A

No; free services are not CE

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Are wearable devices that collect PHI covered by HIPAA?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Are artificial intelligence (AI) programs that analyze patient data considered BAs?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What was added to the 2024 HIPAA update?

A
  • strengthened reproductive privacy
  • reward, similar to qui tam
  • increased care coordination for SUD records
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What is a workforce?

A

Any individual working under the CE’s direct control

(paid employees, volunteers, trainers, interns, outsourced vendors)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What are the three components for determining PHI?

A
  1. identifies a person or a reasonable basis to believe a person could be identified
  2. relates to one’s health condition
  3. is held or transmitted by a CE or its BA
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Decedents according to 2013 Omnibus Final Rule

A

PHI does not have to be retained after 50 yrs

34
Q

What happens with the HIPAA privacy rule under emergencies?

A

Specific parts can be suspended for up to 72 hours

35
Q

What Act covered edu records?

A

Federal Education Records Privacy Act (FERPA)

36
Q

PHI disclosure

A

Dissemination of PHI from a CE/NA

37
Q

PHI Use

A

Handling PHI internal to a CE/BA

37
Q

PHI Request

A

Asking for access to PHI

38
Q

Minimum necessary

A

“need to know” concept

Limits PHI uses, disclosures and request to only the “minimum necessary” amt to accomplish an intended purpose

39
Q

Two situations where HIPAA requires use or disclosure of PHI without an individual’s authorization:

A
  1. Indv or rep requests access
  2. US Dept H&HS is investigating
40
Q

What is TPO? Does it require authorization?

A

Treatment, payment, operations

No but may do it as a courtesy

41
Q

2 Situations where indv can informally agree or object

A
  1. Pt admission directory
  2. Notification to fam/friends
42
Q

For what things is a valid authorization for disclosure of info required? (5)

A
  • PHI that cannot be released w/out authorization
  • psychotherapy notes
  • marketing
  • research
  • sale of PHI
43
Q

What is marketing in HC?

A

Communication about a product or service that encourages the recipient to purchase or use it

44
Q

What did HITECH do in terms of marketing?

A

Limited the def of HC operations to increase the marketing authorization requirement

44
Q

What is the problem with marketing?

A

CEs often classify marketing activities as HC operations NOT requiring authorization

45
Q

When can fundraising be considered part of operations?

A

When it uses de-identified info to raise funds to benefit the org

46
Q

What pt info can be used for fundraising purposes? (6)

A
  • demographics
  • date of HC provided
  • department of service info
  • treating physician
  • outcome info
  • health insurance status
46
Q

HITECH imposes additional requirements on CEs and ____ patients’ ability to easily and inexpensively opt out of fundraising solicitations that use or disclose PHI

A

strengthens

47
Q

When does the notice of privacy practice have to be given?

A

before on on the first visit

47
Q

How long does the notice of privacy practice have to be kept?

A

3 years

47
Q

What is the notice of privacy practices?

A
  • lays out how a CE will use and disclose PHI
  • CE legal duties regarding PHI
47
Q

What does the use and disclosure of psychotherapy notes require?

A

Authorization

48
Q

Is selling PHI a violation of the Notice of Privacy Practices?

A

Yes

49
Q

What happens if the pt refuses to sign the Notice of Privacy Practices?

A

Must be documented; care can’t be withheld

50
Q

Does consent has an expiration date?

A

No

50
Q

T/F: Providers are required to obtain a pt’s signed consent to use/disclose PHI for TPO purposes?

A

False; not required

51
Q

What is authorization?

A

Written permission for specific disclosure (things other than TPO)

52
Q

Key HIPAA elements included in authorization (9)

A
  • name of individual
  • who is making disclosure
  • to whom info is going to
  • type of info disclosed
  • signature of individual
  • date signed
  • expiration date
  • statement of right to revoke
  • redisclosure statement
53
Q

Providing a copy of an emergency room visit report to a PCP is an example of which of the following under HIPAA?

A. Use of protected health information
B. Provision of protected health information
C. Minimum necessary of protected health information
D. Disclosure of protected health information

A

D. Disclosure of protected health information

54
Q

What is the right to request restrictions?

A

Requesting restrictions on uses/disclosures of PHI outside of TPO;

(NOTE: not required to agree if too difficult to carry out request)

55
Q

What is the exception to the right to request restrictions?

A

If individual wishes to not use Health Plan and pay in full with cash

56
Q

What info is included in accounting of disclosures?

A
  • date
  • name/address of entity that recieved info
  • info disclosure
  • statement on purpose of disclosure
57
Q

Who investigates HIPAA violations?

A

HHS- OCR

Office of Civil Rights

57
Q

Who owns the pt record?

A

Provider/ org

58
Q

When a pt is requesting access to records, how long do CEs have to respond after the request was received?

A

30 days (15 days if electronic info)

59
Q

Instances when a pt can be denied access to PHI (3)

A
  • psychotherapy notes
  • correctional institutions if it jeopardizes safety
  • if info was obtained other than provider and access would reveal source of info
60
Q

What did the 21st Century Cures Act do? (2)

A
  • reiterates pt access
  • prohibits info blocking
61
Q

Reasons for having a denied PHI request (2)

A
  • endangers life or safety
  • causes substantial harm to another person mentioned in PHI
62
Q

Explain if it is a HIPAA Privacy rule violation:

Natalie requested a list of people who have reviewed her record. This is her second request of the year. The hospital is charging her $150

A

Yes, excessive fee

62
Q

Explain if it is a HIPAA Privacy rule violation:

The hospital received a request to amend a patient record. They refused to accept the request

A

Yes, have to accept but may not honor request

63
Q

Explain if it is a HIPAA Privacy rule violation:

Bob refused to sign the Notice of Privacy Practice, but the hospital treated him anyway

A

No

63
Q

Explain if it is a HIPAA Privacy rule violation:

Mr. Smith requests a copy of his wife’s medical record but does not include a written authorization from his wife.

A

Yes, need the wife’s authorization

63
Q

What is a breach?

A

unauthorized access, use, or disclosure of PHI

Must demonstrate PHI was compromised

64
Q

Omnibus rule’s 3 exceptions to breach notification rule

A
  1. PHI disclosure was not intentional
  2. access to PHI was unintentional by a workforce member
  3. HC org has good faith the PHI was not retained
65
Q

Breach notification notice is for… (2)

A
  • individuals affected
  • HSS via online portal
66
Q

HIPAA Breach Notification Requirements: 9-499 individuals

A

Web posting and media notification

67
Q

What does preemption do?

A

Gives legal precedence to federal law when it conflicts with state law

67
Q

HIPAA Breach Notification Requirements: 500+ individuals

A

notice to media outlets and Secretary of HHS

68
Q

Is this a HIPAA violation?

There was an overdose at 17 Tyler Road around 1:30 this morning. Charleston County responded and the female in the home was taken via ambulance to the hospital. Per the officers, it was cocaine and pills

A

No, the resident is not a CE or BA.

69
Q

How many tiers of HIPAA violation penalties are there?

A

4

70
Q

HIPAA Violation Penalties: Tier 1

A

Unaware of HIPAA violation

71
Q

HIPAA Violation Penalties: Tier 2

A

Had reasonable cause and not willful neglect

72
Q

HIPAA Violation Penalties: Tier 3

A

Had willful neglect and corrected within 30 days of discovery

73
Q

HIPAA Violation Penalties: Tier 4

A

Had willful neglect and not corrected as required

Aspects of Health Law (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions