The HIPAA Privacy Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The HIPAA Privacy Rule flashcards as text
Under the HIPAA Privacy Rule, which of the following entities is considered a 'covered entity'?
Answer: A health plan that pays for medical care
Health plans are one of the three categories of covered entities under HIPAA, along with healthcare providers and healthcare clearinghouses.
What is the maximum time a covered entity has to respond to a patient's request to access their PHI?
Answer: 30 calendar days, with one 30-day extension if needed
Covered entities must act on access requests within 30 days, with the option to extend by an additional 30 days if they provide written notice of the delay and the reason.
Which of the following best describes a 'hybrid entity' under HIPAA?
Answer: A single legal entity that performs both covered and non-covered functions
A hybrid entity is a single legal entity whose business activities include both covered functions and non-covered functions, such as a university with a medical center.
The HIPAA Privacy Rule permits covered entities to disclose PHI to public health authorities without patient authorization for which purpose?
Answer: Preventing or controlling disease, injury, or disability
Covered entities may disclose PHI to authorized public health authorities for activities like disease surveillance, reporting, and control without patient authorization.
A patient requests that their provider not share their PHI with their health plan for a service the patient paid for out-of-pocket. Under HIPAA, the provider must:
Answer: Honor the restriction request as required by HITECH-amended HIPAA
Under the HITECH Act amendment to HIPAA, providers must honor a patient's request to restrict disclosure to a health plan when the patient pays out-of-pocket in full.
Which of the following uses of PHI requires a specific written patient authorization under the HIPAA Privacy Rule?
Answer: Using PHI for most marketing communications that are not treatment-related
Using PHI for most marketing communications requires a valid written authorization because marketing is not within the TPO or other permitted uses.
Under the HIPAA Privacy Rule, what is a 'business associate'?
Answer: A person or entity that performs functions or activities on behalf of a covered entity involving PHI
A business associate is a person or entity that performs functions or activities on behalf of a covered entity that involve creating, receiving, maintaining, or transmitting PHI.