HIPAA - Health Insurance Portability and Accountability Act The HIPAA Privacy Rule Questions and Answers

Question 1

A hospital billing department needs to send a list of patient accounts to a third-party collection agency.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following actions is most appropriate?

Accepted Answer

Disclose only the demographic and financial information necessary for collection purposes.

Answer

Send the entire medical record for each patient to provide complete context.

Answer

Provide the patient's name and total amount due, but no contact information.

Answer

Refuse to disclose any information without a court order for each individual patient.

Question 2

Under the HIPAA Privacy Rule, which of the following is NOT considered Protected Health Information (PHI)?

Accepted Answer

A de-identified health summary used for a statistical study.

Answer

A patient's medical record number.

Answer

An email from a patient to their doctor's office.

Answer

A photograph of a patient's face stored in their electronic health record.

Question 3

A patient exercises their right to access their PHI and requests a copy of their medical records from a covered entity. The covered entity has a policy of charging a flat fee of $100 for all record requests to cover costs. This policy is:

Accepted Answer

Not permissible, as covered entities can only charge a reasonable, cost-based fee and must inform the patient of the approximate fee in advance.

Answer

Permissible, as covered entities can charge for the labor involved in copying records.

Answer

Permissible, as long as the fee is applied uniformly to all patients.

Answer

Not permissible, as covered entities are required to provide the first copy of records for free.

Question 4

In which of the following scenarios is a covered entity permitted to disclose PHI without the patient's authorization?

Accepted Answer

To a public health authority for disease surveillance purposes as required by law.

Answer

To a pharmaceutical company for marketing purposes.

Answer

To the patient's employer to verify sick leave.

Answer

To a journalist writing a story about the hospital's new technology.

Question 5

A patient's friend calls a hospital and asks for an update on the patient's condition. The patient is conscious and able to make their own decisions. According to the HIPAA Privacy Rule, what should the hospital staff do?

Accepted Answer

Inform the patient of the friend's inquiry and ask the patient if they consent to the disclosure.

Answer

Provide a general, one-word condition update (e.g., 'stable').

Answer

Refuse to provide any information, citing HIPAA.

Answer

Give the friend the patient's room number and direct visiting hours.

Question 6

Which of the following rights does the HIPAA Privacy Rule grant to individuals regarding their Protected Health Information (PHI)?

Accepted Answer

The right to demand that their health plan not be informed of treatment for which they paid out-of-pocket in full.

Answer

The right to have factually incorrect information removed from their medical record entirely.

Answer

The right to receive a free, comprehensive audit trail of every internal access to their electronic record.

Answer

The right to sue a business associate directly for a privacy violation.