AAMA HIPAA and Scope of Practice 2 — Questions and Answers
Question 1: A patient calls asking for their spouse's lab results. The spouse is not present. What should the medical assistant do?
- Release the results since they are married
- Ask the spouse to call back themselves
- Release results only if the patient has signed a HIPAA authorization naming the spouse (Correct answer)
- Release results after verifying the caller's identity
Correct answer: Release results only if the patient has signed a HIPAA authorization naming the spouse
PHI can only be shared with a third party if the patient has provided written authorization specifically naming that individual.
Question 2: Which of the following is an example of a HIPAA-compliant way to dispose of PHI?
- Placing documents in the regular trash
- Shredding documents before disposal (Correct answer)
- Leaving documents in a recycling bin
- Storing documents in an unlocked cabinet
Correct answer: Shredding documents before disposal
HIPAA requires that PHI be rendered unreadable before disposal; shredding is the standard method for paper documents.
Question 3: A medical assistant overhears a coworker discussing a patient's diagnosis in the hallway where others can hear. This is a violation of which HIPAA rule?
- Security Rule
- Enforcement Rule
- Privacy Rule (Correct answer)
- Breach Notification Rule
Correct answer: Privacy Rule
The HIPAA Privacy Rule protects PHI from unauthorized verbal disclosures in public or semi-public settings.
Question 4: Under the HIPAA Minimum Necessary Standard, when a medical assistant pulls a patient chart, they should access:
- The entire chart to be thorough
- Only the information needed to perform their specific task (Correct answer)
- Only the billing information
- Only information approved by the physician
Correct answer: Only the information needed to perform their specific task
The Minimum Necessary Standard requires accessing only the PHI needed to accomplish the intended purpose.
Question 5: A Business Associate Agreement (BAA) is required when a covered entity shares PHI with:
- Another physician in the same practice
- A vendor who handles PHI on behalf of the practice (Correct answer)
- A patient requesting their own records
- A family member named in a patient's authorization
Correct answer: A vendor who handles PHI on behalf of the practice
A BAA is a HIPAA-required contract between a covered entity and a business associate who creates, receives, or transmits PHI.
Question 6: Which entity enforces HIPAA Privacy and Security Rules?
- Centers for Medicare & Medicaid Services (CMS)
- Office for Civil Rights (OCR) (Correct answer)
- American Medical Association (AMA)
- Joint Commission
Correct answer: Office for Civil Rights (OCR)
The HHS Office for Civil Rights is the federal agency responsible for enforcing HIPAA Privacy and Security Rules.
Question 7: A patient requests an amendment to their medical record. Under HIPAA, the covered entity must respond within how many days?
- 30 days
- 60 days (Correct answer)
- 90 days
- 10 days
Correct answer: 60 days
HIPAA requires covered entities to act on a request for amendment within 60 days, with one possible 30-day extension.
AAMA HIPAA and Scope of Practice 2
A patient calls asking for their spouse's lab results.
The spouse is not present.
What should the medical assistant do?