AHIMA AHIMA Release of Information 2 — Questions and Answers
Question 1: Which state law generally takes precedence when it provides greater privacy protections than HIPAA?
- HIPAA always supersedes state law
- State law prevails when it is more stringent (more protective of patient privacy) than HIPAA (Correct answer)
- Federal law always preempts state law for health records
- State law applies only to Medicaid patients
Correct answer: State law prevails when it is more stringent (more protective of patient privacy) than HIPAA
HIPAA establishes a federal floor of privacy protections, but states may enact stricter laws; in such cases, the more stringent state law applies.
Question 2: What additional federal protections apply to substance use disorder treatment records beyond standard HIPAA requirements?
- Joint Commission accreditation standards
- 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records) (Correct answer)
- The Mental Health Parity Act
- CMS Conditions of Participation
Correct answer: 42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records)
42 CFR Part 2 imposes stricter confidentiality requirements on records of patients treated for substance use disorders at federally assisted programs, requiring specific patient consent for most disclosures.
Question 3: Under HIPAA, what is a 'business associate'?
- Any vendor that sells products to a hospital
- A person or entity that performs functions or activities on behalf of a covered entity involving PHI (Correct answer)
- An employee of the covered entity
- A health plan member
Correct answer: A person or entity that performs functions or activities on behalf of a covered entity involving PHI
A business associate is a person or organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity to perform a function or service.
Question 4: What is the correct process when a patient revokes a previously signed HIPAA authorization?
- The covered entity must immediately stop all disclosures, with no exceptions
- Disclosures that already occurred in reliance on the authorization are not affected, but future disclosures must stop (Correct answer)
- The revocation must be notarized to be valid
- Revocation applies only to electronic records
Correct answer: Disclosures that already occurred in reliance on the authorization are not affected, but future disclosures must stop
A patient may revoke a HIPAA authorization in writing at any time, but the revocation does not affect disclosures already made in reliance on the authorization.
Question 5: Which of the following is an example of a permitted disclosure of PHI without patient authorization under HIPAA's public interest exceptions?
- Sharing records with a patient's adult child without consent
- Reporting communicable diseases to a state or local public health authority (Correct answer)
- Disclosing records for employment background checks
- Providing records to a marketing research firm
Correct answer: Reporting communicable diseases to a state or local public health authority
HIPAA permits disclosure of PHI without authorization to public health authorities authorized by law to collect information for preventing or controlling disease or injury.
Question 6: What must a covered entity include in its Notice of Privacy Practices (NPP)?
- A list of all patients' names and diagnoses
- A description of how PHI may be used and disclosed, patient rights, and how to file a complaint with HHS (Correct answer)
- The facility's billing codes and fee schedule
- Employee access log policies only
Correct answer: A description of how PHI may be used and disclosed, patient rights, and how to file a complaint with HHS
The NPP must describe the covered entity's uses and disclosures of PHI, patient rights (access, amendment, accounting), how to exercise those rights, and how to file a complaint with HHS OCR.
AHIMA AHIMA Release of Information 2
Which state law generally takes precedence when it provides greater privacy protections than HIPAA?