The Omnibus Rule Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 The Omnibus Rule flashcards as text
Under the Omnibus Rule, which of the following is a permissible use of PHI for health care operations WITHOUT individual authorization?
Answer: Sharing PHI with a sister covered entity for joint quality improvement activities
Covered entities that are under common ownership or control may share PHI for joint healthcare operations activities such as quality improvement without individual authorization.
When the Omnibus Rule refers to 'remuneration' in the context of the sale of PHI, which of the following is generally excluded from this definition?
Answer: Reasonable costs of preparing and transmitting PHI for a permitted disclosure
Reasonable preparation and transmission costs for permissible disclosures are excluded from the definition of remuneration under the Omnibus Rule's sale-of-PHI prohibition.
Under the Omnibus Rule, what must a business associate agreement (BAA) include regarding subcontractors?
Answer: A provision requiring the business associate to enter into BAAs with its subcontractors
The Omnibus Rule requires that BAAs include a provision obligating business associates to enter into compliant BAAs with any subcontractors who create, receive, maintain, or transmit PHI.
Under the Omnibus Rule, how did the definition of 'workforce' change with respect to HIPAA compliance obligations?
Answer: The workforce definition was expanded to explicitly include volunteers and trainees under HIPAA obligations
The Omnibus Rule confirmed that the workforce definition includes volunteers, trainees, and other persons under the direct control of a covered entity.
A hospital sends a patient's PHI to a law firm to defend against a malpractice lawsuit. Under the Omnibus Rule, how is the law firm classified?
Answer: A business associate because it receives PHI to perform services on the hospital's behalf
A law firm that receives PHI to perform legal services on behalf of a covered entity is considered a business associate and must sign a BAA.
Under the Omnibus Rule, which of the following statements about the enforcement of civil monetary penalties (CMPs) is accurate?
Answer: Business associates are now directly subject to CMPs for HIPAA violations
The Omnibus Rule made business associates directly subject to civil monetary penalties for HIPAA violations, in addition to covered entities.
Under the Omnibus Rule, a covered entity discovers an impermissible disclosure of PHI by a workforce member acting with willful neglect that is not corrected. What penalty tier applies?
Answer: $50,000–$1,500,000 per violation (willful neglect — not corrected tier)
Willful neglect violations that are not corrected within 30 days carry the highest penalty tier of $50,000 to $1,500,000 per violation per calendar year.