RHIT Release of Information and Privacy Practices 2 — Questions and Answers
Question 1: Which of the following individuals has the right to authorize release of a deceased patient's records?
- Any family member of the deceased
- The deceased patient's personal representative or estate executor (Correct answer)
- The attending physician at time of death
- No one; deceased records can never be released
Correct answer: The deceased patient's personal representative or estate executor
After a patient's death, the personal representative (such as an estate executor) holds the rights to authorize disclosure of the deceased patient's PHI.
Question 2: A release of information (ROI) specialist receives a request for records from a patient's neighbor claiming to be a caregiver. What should the specialist do?
- Release the records since the neighbor stated they are a caregiver
- Require a signed authorization from the patient or documented legal authority before releasing (Correct answer)
- Contact the treating physician to obtain verbal approval
- Release only the diagnosis summary
Correct answer: Require a signed authorization from the patient or documented legal authority before releasing
Without a signed patient authorization or documented legal authority such as a healthcare proxy, records may not be released to third parties regardless of their stated relationship.
Question 3: What is an accounting of disclosures under HIPAA?
- A financial record of all fees charged for record copies
- A patient's right to receive a list of certain disclosures of their PHI made without authorization (Correct answer)
- A log of all employees who accessed the EHR system
- A summary of all authorized releases sent to insurance companies
Correct answer: A patient's right to receive a list of certain disclosures of their PHI made without authorization
HIPAA gives patients the right to receive an accounting of disclosures—a list of certain PHI disclosures made without authorization during the previous six years.
Question 4: Which disclosure is mandated by law and does NOT require patient authorization?
- Disclosure to a patient's employer for workers' compensation claims in states with applicable law (Correct answer)
- Disclosure to a marketing agency for promotional use
- Disclosure to another health system for treatment coordination
- Disclosure to a patient's attorney upon request
Correct answer: Disclosure to a patient's employer for workers' compensation claims in states with applicable law
Many states have workers' compensation laws that require disclosure of relevant health information without patient authorization when the employer or insurer is a party to the claim.
Question 5: A patient requests amendment of their medical record, claiming a diagnosis is incorrect. Under HIPAA, the covered entity may deny the request if:
- The record was created more than five years ago
- The information was not created by the covered entity and the originator is available to amend it (Correct answer)
- The patient disagrees with the physician's clinical judgment
- The amendment would increase reimbursement
Correct answer: The information was not created by the covered entity and the originator is available to amend it
HIPAA allows denial of an amendment request if the covered entity did not create the information and the originating entity is reasonably available for the amendment.
Question 6: Which document notifies patients about how their PHI may be used and disclosed?
- Business Associate Agreement (BAA)
- Notice of Privacy Practices (NPP) (Correct answer)
- Advance Beneficiary Notice (ABN)
- Certificate of Destruction
Correct answer: Notice of Privacy Practices (NPP)
The Notice of Privacy Practices (NPP) is required by HIPAA and informs patients of their privacy rights and how the covered entity may use and disclose their PHI.
RHIT Release of Information and Privacy Practices 2
Which of the following individuals has the right to authorize release of a deceased patient's records?