The Omnibus Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The Omnibus Rule flashcards as text
Under the Omnibus Rule, which of the following best describes a 'subcontractor' of a business associate?
Answer: A person or entity that creates, receives, maintains, or transmits PHI on behalf of a business associate
The Omnibus Rule extended the definition of business associate to include subcontractors who handle PHI on behalf of a business associate.
The Omnibus Rule changed the definition of 'marketing' under HIPAA. Which of the following is NOT considered marketing under the revised definition?
Answer: Communications about treatment alternatives for the individual
Treatment communications describing health-related products or services are excluded from the definition of marketing and do not require authorization.
Under the Omnibus Rule, when a business associate agreement (BAA) is in place and a subcontractor breaches it, who bears direct liability to HHS?
Answer: Both the business associate and the subcontractor
The Omnibus Rule made subcontractors directly liable under HIPAA, meaning both business associates and their subcontractors can be held liable by HHS.
Which of the following correctly describes the Omnibus Rule's approach to the minimum necessary standard for uses and disclosures?
Answer: Covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose
The minimum necessary standard requires covered entities and business associates to make reasonable efforts to limit PHI access and disclosure to what is needed for the intended purpose.
Under the Omnibus Rule, what is the maximum penalty per violation category per calendar year?
Answer: $1,500,000
The Omnibus Rule set the maximum civil monetary penalty at $1,500,000 per violation category per calendar year.
The Omnibus Rule modified the Breach Notification Rule by changing the standard for what constitutes a breach. What is the new presumption?
Answer: Any impermissible use or disclosure is presumed to be a breach unless the covered entity proves low probability of compromise
The Omnibus Rule replaced the 'harm' standard with a presumption that any impermissible use or disclosure is a breach unless a low probability of compromise can be demonstrated.
Under the Omnibus Rule, individuals have a right to request restrictions on disclosures of PHI to health plans when the individual pays out-of-pocket in full. What must a covered entity do in this situation?
Answer: Comply with the restriction request if it relates to the specific item or service paid for out-of-pocket
The Omnibus Rule requires covered entities to honor a patient's restriction request when the patient pays out-of-pocket in full for a specific item or service.