HIPAA and Scope of Practice Flashcards
7 cards from real AAMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 HIPAA and Scope of Practice flashcards as text
A patient asks the medical assistant to not share their HIV status with their primary care physician. The medical assistant should:
Answer: Explain that treatment-related disclosures within the care team are permitted under HIPAA
HIPAA permits disclosures among treating providers for treatment purposes, and the medical assistant should explain this exception to the patient.
Which of the following is an appropriate administrative safeguard required by the HIPAA Security Rule?
Answer: Conducting regular workforce training on security policies
Workforce training on security policies is classified as an administrative safeguard under the HIPAA Security Rule.
A medical assistant correctly performs a task that is within their scope but causes patient harm due to negligence. This is an example of:
Answer: Malpractice or negligence, not a scope violation
Performing an authorized task negligently constitutes malpractice, not a scope-of-practice violation.
Patients have the HIPAA right to request restrictions on the use of their PHI. The covered entity:
Answer: Must agree only if the patient pays out-of-pocket and the restriction involves disclosures to health plans
HIPAA requires covered entities to honor restrictions when the patient pays in full out-of-pocket and the restriction pertains to disclosures to health plans for payment purposes.
When a minor patient's parent requests access to the minor's medical records, the medical assistant should:
Answer: Follow state law, which may grant the minor privacy rights in certain situations
State law governs parental access to minor records; in some situations (e.g., reproductive health, substance abuse), minors may have independent privacy rights.
A medical assistant who performs a venipuncture without proper training or authorization may face:
Answer: Civil liability and potential disciplinary action for practicing beyond scope
Performing procedures outside authorized scope can result in civil liability, loss of certification, and disciplinary action even if no harm occurs.
Under HIPAA, which of the following is an example of a physical safeguard for ePHI?
Answer: Locking server rooms and restricting physical access to workstations
Physical safeguards include controls over physical access to facilities and equipment that store ePHI, such as locked server rooms.