Patient Rights Under HIPAA Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Patient Rights Under HIPAA flashcards as text
A minor patient's parent requests access to the child's medical records. Under HIPAA, the parent's right to access is generally:
Answer: Subject to state law and certain exceptions
Parents are generally the personal representatives of minors, but state law and specific HIPAA exceptions can limit this access.
Which entity is designated under HIPAA to receive complaints about privacy rights violations?
Answer: The Office for Civil Rights (OCR) within HHS
The HHS Office for Civil Rights (OCR) enforces the HIPAA Privacy Rule and receives patient complaints.
A patient requests their records be sent directly to another provider. Under the HIPAA right of access, the original provider must:
Answer: Send the records in the format requested if readily producible
HIPAA requires covered entities to provide PHI in the format the patient requests if it is readily producible in that form.
Under HIPAA, what is the maximum look-back period for which a patient can request an accounting of disclosures?
Answer: 6 years
Patients may request an accounting covering up to 6 years prior to the date of the request.
A patient's legal guardian submits a request to access the patient's PHI. Under HIPAA, the guardian is treated as:
Answer: A personal representative with the same rights as the patient
HIPAA recognizes personal representatives, including legal guardians, as having the same access rights as the patient.
Which of the following actions is a covered entity PROHIBITED from doing in response to a patient exercising their HIPAA privacy rights?
Answer: Retaliating by denying treatment or services
HIPAA expressly prohibits covered entities from retaliating against patients who exercise their privacy rights.
A patient asks a covered entity to amend a record and the entity agrees. What must the entity do next?
Answer: Inform the patient and identify persons or entities that need the amendment
When agreeing to an amendment, the entity must notify the patient and share the amendment with relevant parties who received the original PHI.