HIPAA Privacy Rule Concepts and Patient Access

Question 1

List the Core Elements

Authorization

What must an authorization form contain?

Answer 1

• Description of the info that will be disclosed
• Name of the individual
• Name of the person authorized to make the disclosure
• Name or identification of the recipient
• Description of each purpose of the disclosure
• Expiration date or expiration event
• Individual’s or representative’s signature and date

Question 2

List required information contained in the document

Authorization

Not the core elements

Answer 2

• Description/notification of the right to revoke the authorization
• Inability to condition treatment, payment, enrollment or benefit eligibility on whether the individual signs the authroization
• Notification that info disclosed according to the authorization could lose HIPAA protection and be redisclosed by the recipient

Question 3

List possible reasons

Defective Authorization

Answer 3

• Passed expiration date
• Incomplete/missing required elements/information
• Authorization was revoked
• Violates compound authorization requirements
• Contains false information
• Conditions treatment, payment, enrollment in a health plan, or eligibility of benefits on signing the form

Question 4

Define or List the Elements

Psychotherapy Notes

Answer 4

• Behavioral Health notes
• Recorded by a mental health professional
• Documents or analyzes contents or impressions of conversations in private counseling sessions

Question 5

Psychotherapy Notes do not contain

Answer 5

• Start and stop times
• Prescriptions and monitoring
• Treatment modalities and frequencies
• Test results
• Summaries of the individual’s symptoms, diagnosis, prognosis, treatment plan, functional status, or progress to date

Question 6

Circumstances where psychotherapy notes do not require a specific authorization:

Answer 6

• Rendering treatment by the originator of the notes
• Conducting counseling training
• Defending legal action brought by the individual

Question 7

The two situations where HIPAA requires use or disclosure of PHI without the individual’s authorization

Answer 7

1. The individual (or their rep) requests access to PHI or an accounting of disclosures of their PHI
2. The DHHS is conducting an investigation, review, or enforcement action

Question 8

Two situations where HIPAA does not require authorization, but the patient must be notified in advance and given the opportunity to informally agree or object

Answer 8

1. Inclusion in a facility directory
2. Disclosure of relevant PHI to a **family member, relative, or friend **who is involved in the individual’s care or payment

Question 9

Three items covered entity’s can share for patients in a facility directory

Answer 9

1. Name
2. Location in the facility
3. Condition (described in general terms)

Question 10

Name the 12 Pubilic Interest and Benefit Exceptions to the authorization requirement

Answer 10

1. As required by law
2. Public health activities
3. Victims of abuse, neglect, or domestic violence
4. Healthcare oversight activities
5. Judicial and administrative proceedings
6. Law enforcement purposes
7. Decedents
8. Cadaveric organ, eye, or tissue donation
9. Research
10. Threat to health and safety
11. Essential (Specialized) government functions
12. Workers’ compensation

Question 11

The use or disclosure of PHI for public health activities serves what purposes?

Answer 11

1. Preventing or controlling diseases, injuries, and disabilities
2. Reporting disease, injury (such as child abuse) and vital events such as births and deaths
3. Public health surveillance, investigation, and interventions

Question 12

Provide two examples of public health activities

Answer 12

1. Reporting of adverse eents or product defects in order to complay with FDA regulations
2. When authorized by law, reporting a person who may have been exposed to a communicable disease and might be at risk for contracting or spreading it

Question 13

Is written authorization required to disclose student immunization records?

Answer 13

No

Need documented verbal agreement from parent/guardian/emancipated minor

Question 14

List reasons for disclosing PHI to a coroner or medical examiner

Answer 14

• To identify a deceased person
• To determine a cause of death
• To accomplish other purposes required by law

Question 15

Is authorization required to disclose PHI to medical examiners, coroners, or funeral directors?

Answer 15

• Not for medical examiners coroners for purposes of identifying a deceased person, determining a cause of death, or accomplishing other purposes required by law.
• Not for funeral directors if the purpose is for them to carry out thier duties.

Question 16

Define Incidental uses and disclosures and provide an example

Answer 16

• Uses and disclosures that occur as part of doing business.
• Example: Calling out patient’s names in a physician’s office

Question 17

What deidentification restrictions are lifted in a limited data set?

Answer 17

• Ages and dates
• Elements of geographic subdivisions (such as city, state, and zip code)
• Other unique identifying information (as appropriate)

Question 18

Concerning research, in what circumstances can PHI be used or disclosed without an authorization of opportunity to agree or object?

Answer 18

The PHI is used or disclosed only for:
* Research,
* Public health, or
* Healthcare operations

Question 19

Name the agreement that must be in place to use a limited data set

Answer 19

Data Use Agreement

Question 20

Name five instances where HIPAA does not preempt state law, even though the state law is not more stringent

Answer 20

HIPAA does not preempt state laws that:
1. Prevent healthcare fraud and abuse
2. Regulate health plans
3. Complete state reporting on healthcare delivery or costs
4. Serve a compelling public health, safety, or welfare need
5. Provide for the reporting of vital statistics and other public health data

Question 21

List the individual rights HIPAA provides to individuals regarding their PHI

Answer 21

1. Access
2. Amendment
3. Accounting of Disclosures
4. Restriction Requests
5. Confidential Communications

Question 22

Explain why the Cures Act Information Blocking Rule was designed

Answer 22

To eliminate barriers that impede sharing and exchange of patient information for a large scope of patient records.

Question 23

Define Information Blocking

Answer 23

Conduct that is likely to interfere with access, exchange, or use of electronic health information.

Question 24

Define Electronic Health Information (EHI)

Answer 24

Electronic protected health information (ePHI) that would be included in a designated record set (DRS).

Question 25

Provide examples of **Actors** in the context of information blocking prohibitions

Answer 25

* Healthcare providers * Health information IT developers of certified health IT * Health information exchanges * Health information networks

Question 26

List the circumstances when a CE can **deny** an amendment request

Answer 26

1. PHI was not created by the CE 2. PHI is not part of the DRS 3. PHI is not available for inspection per access restrictions* 4. The PHI is accurate and complete ## Footnote *For example, psychotherapy notes.

Question 27

Covered entity's may require these two items before considering an **amendment request**

Answer 27

1. A written amendment request 2. A reason for requesting the amendment ## Footnote The requirments must be communicated in advance, usually in the NPP.

Question 28

A CE must act on an individual's amendment request within \_\_ days by granting or denying it in writing.

Answer 28

60 Days

Question 29

A CE may **extend** its amendment request response time by up to \_\_ days

Answer 29

30 Days | Must provide the reason for the delay in writing and a completion date

Question 30

In an individual writes a **disagreement to a amendment denial**, what four items must be appended or linked to the subject record or PHI?

Answer 30

1. The amendment request 2. The denial 3. The individual's disagreement 4. A rebuttal **(if one was created)** | These items or a summary must accompany future disclosures.

Question 31

In the context of **accounting of disclosures**, one activity that appears to be a healthcare operation, but is not, is \_\_\_\_\_

Answer 31

Mandatory public health reporting. ## Footnote **Example:** The reporting of births, deaths, and communicable diseases.

Question 32

List the items that must be included in an **accounting of disclosures**

Answer 32

1. The date of disclosure 2. The name and address (when known) of the entity or person who received the information 3. A brief description of the PHI disclosed 4. A brief statement of the purpose of the disclosure or a copy of the request for a disclosure

Question 33

An **account of disclosures** must address disclosures during the previous \_\_\_\_\_\_\_\_\_.

Answer 33

Six years

Question 34

Covered entity's must agree to an individual's **restriction request** if

Answer 34

A disclosure would be made to a health plan for payment or healthcare operations (and not for treatment) **and** the PHI pertains solely to an item or service for which the provider has been paid in full other than by the health plan.

Question 35

**Confidential communications** refers to

Answer 35

The opportunity to request that **communications of PHI be routed to an alternative location or by an alternative method**.

Question 36

List two common communications that fit the definition of marketing but **do not require authorization**.

Answer 36

1. Those that occur **face-to-face** between the covered entity and the individual 2. Those that concern a promotional **gift of nominal value** provided by the covered entity* ## Footnote **Example:** A free toothbrush at a dentist visit.

Question 37

List the items HIPAA permits covered entities to disclose a business associate or institutionally related foundation without authorization for its own **fundraising** purposes

Answer 37

1. Individual's demographic information 2. Dates the individual received healthcare services 3. Department of service 4. Treating physician 5. Health insurance information 6. Outcome information

Question 38

The **HIPAA Breach Notification Rule** requires covered entities and business associates to make notifications when

Answer 38

Protected health information has been breached

Question 39

Impermissible uses or disclosures of PHI are presumed to be breaches unless

Answer 39

The covered entity or business associate demonstrate a **"low probability"** that the PHI has been compromised

Question 40

List the information that must be shared with an individual **whose PHI has been breached**

Answer 40

1. A description of what occurred, including the date of the breach and the date it was discovered 2. The types of unsecured PHI involved 3. Steps the individual may take to protect themself 4. What the entity is doing to investigate, mitigate, and prevent future occurrences 5. Contact information the individual can use to ask questions and receive updates

Question 41

Define **Mitigation**

Answer 41

The lessening of negative consequences.