The HIPAA Privacy Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The HIPAA Privacy Rule flashcards as text
A hospital shares a patient's PHI with a collection agency to recover an unpaid bill. Under HIPAA, this is considered:
Answer: A permitted disclosure for payment purposes under HIPAA
Disclosing PHI to a collection agency for payment purposes is a permitted use under HIPAA, provided the agency signs a Business Associate Agreement.
Which of the following scenarios describes a valid authorization under the HIPAA Privacy Rule?
Answer: A specific written authorization for releasing records to a life insurance company, signed by the patient with an expiration date
A valid HIPAA authorization must be specific, written, signed, include an expiration date or event, and cannot be conditioned on receiving treatment.
Under the HIPAA Privacy Rule, 'treatment' as a permitted use of PHI includes:
Answer: Sharing PHI among healthcare providers for coordination and management of a patient's care
Treatment includes the coordination and management of care among multiple providers, including consultations and referrals.
What is an 'Organized Health Care Arrangement' (OHCA) under the HIPAA Privacy Rule?
Answer: A clinically integrated care setting where multiple entities share PHI for treatment
An OHCA is a clinically integrated care setting where individuals receive care from multiple providers who share PHI to manage and coordinate patient treatment.
When a patient requests an amendment to their PHI and the covered entity denies it, what must the covered entity do?
Answer: Provide the patient with a written denial and inform them of their right to submit a statement of disagreement
When denying an amendment request, the covered entity must provide written notice of the denial and inform the patient of their right to submit a statement of disagreement.
Which of the following is an example of incidental disclosure that is permissible under HIPAA?
Answer: A physician discussing a patient's case with a colleague in a hallway while taking reasonable precautions
Incidental disclosures that occur as a byproduct of reasonable communications are permitted under HIPAA, provided the covered entity has implemented appropriate safeguards.
Under the HIPAA Privacy Rule, a patient's right to an accounting of disclosures covers disclosures made for which purpose?
Answer: Purposes other than treatment, payment, and healthcare operations
Patients have the right to an accounting of disclosures made for purposes other than TPO, such as public health activities or law enforcement, covering the past 6 years.