Confidentiality & Privacy Standards Flashcards
7 cards from real CACS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Confidentiality & Privacy Standards flashcards as text
Which of the following represents a HIPAA-adjacent privacy concern that CACs must be aware of when transferring consumers from Medicaid to Marketplace coverage?
Answer: Medical information held by Medicaid may be subject to different confidentiality protections than Marketplace enrollment data
Medicaid records are protected under both HIPAA and additional federal regulations, and CACs must respect those protections when facilitating transitions to Marketplace coverage.
A CAC receives a subpoena requesting consumer enrollment records. The CAC should:
Answer: Consult with their organization's legal counsel before releasing any information
A subpoena may or may not require disclosure depending on its scope and applicable law; the CAC must consult legal counsel before releasing any consumer records.
When using a consumer's phone number to send appointment reminders, a CAC should ensure:
Answer: The reminder is generic and does not reveal that the purpose involves health coverage enrollment
Appointment reminders sent to phones should not disclose sensitive information such as the health coverage enrollment purpose in case the message is seen by others.
A CAC's certification is revoked. What should happen to the consumer records they maintained?
Answer: Records should be transferred to the CAC's supervising organization or successor per established protocols
Upon revocation of certification, consumer records must be transferred to the supervising organization or a designated successor to ensure continuity and continued privacy protection.
Which of the following is an example of a permissible use of consumer information collected during enrollment?
Answer: Contacting a consumer to inform them of an upcoming enrollment deadline affecting their current plan
Contacting a consumer about their own enrollment timeline is a permissible use of their contact information for the purpose for which it was collected.
A consumer enrolls through a CAC but later requests their file be deleted from the CAC's records. How should the CAC respond?
Answer: Explain that records must be retained for the regulatory minimum period, but no further use or sharing will occur
CACs are required by regulation to retain records for a minimum period and cannot delete them on demand, but can assure the consumer that access and use will be strictly limited.
What does 'de-identification' of consumer data mean in the context of CAC privacy standards?
Answer: Removing all identifiers that could link the data back to a specific individual
De-identification requires removing all 18 HIPAA-defined identifiers (or using statistical methods) so that data cannot reasonably be linked back to a specific person.