The HIPAA Privacy Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The HIPAA Privacy Rule flashcards as text
Under the HIPAA Privacy Rule, which of the following is a permissible disclosure of PHI in judicial proceedings?
Answer: Disclosing PHI in response to a court order or a subpoena with satisfactory assurances
PHI may be disclosed in judicial proceedings in response to a court order or a subpoena accompanied by satisfactory assurances of patient notification or a protective order.
What distinguishes 'psychotherapy notes' from other mental health records under the HIPAA Privacy Rule?
Answer: They receive heightened protection and generally require specific authorization for disclosure separate from other PHI
Psychotherapy notes are given special protection under HIPAA and generally require separate, specific patient authorization to disclose, even for TPO purposes.
A covered entity's workforce member improperly accesses a celebrity patient's records out of curiosity. This is an example of:
Answer: An impermissible use of PHI that violates the Privacy Rule
Accessing PHI for personal curiosity without a legitimate purpose is an impermissible use that violates the HIPAA Privacy Rule's minimum necessary and permissible use standards.
Under HIPAA, which of the following correctly describes the relationship between HIPAA and state privacy laws?
Answer: State laws that provide greater privacy protections than HIPAA are generally not preempted
HIPAA sets a federal floor; state laws that provide stronger privacy protections are generally not preempted and may also apply to covered entities.
When must a covered entity provide a patient with its Notice of Privacy Practices (NPP)?
Answer: At the first service delivery and upon request thereafter
Covered entities must provide the NPP no later than the date of first service delivery and must make it available to any person who requests it.
Which federal agency enforces the HIPAA Privacy Rule?
Answer: The Office for Civil Rights (OCR) within the Department of Health and Human Services
The Office for Civil Rights (OCR) within HHS is responsible for enforcing the HIPAA Privacy Rule and investigating complaints of violations.
A covered entity uses PHI to train new staff on privacy procedures using real patient cases without removing identifiers. This is:
Answer: Permitted as a healthcare operations activity under HIPAA
Using PHI for workforce training and quality assurance activities qualifies as a healthcare operations purpose under HIPAA and does not require patient authorization.