NCMA HIPAA and Patient Privacy Rights 2

Question 1

Under HIPAA, what is a 'Business Associate Agreement' (BAA) and when is it required?

Accepted Answer

A contract required when a covered entity shares PHI with a third-party vendor or service provider that performs functions on its behalf

Answer

An agreement between two competing healthcare practices to share patients

Answer

A financial agreement between a physician and hospital system

Answer

An agreement between the patient and the billing department regarding payment terms

Question 2

What are the three HIPAA safeguard categories under the Security Rule, which applies specifically to electronic PHI (ePHI)?

Accepted Answer

Administrative, physical, and technical safeguards

Answer

Privacy, confidentiality, and integrity safeguards

Answer

Procedural, personnel, and digital safeguards

Answer

Organizational, departmental, and individual safeguards

Question 3

A medical assistant overhears a colleague discussing a patient's HIV status in the hospital cafeteria with another colleague. What is the appropriate action?

Accepted Answer

Politely remind the colleagues that discussing PHI in public areas violates HIPAA and report the incident to the privacy officer if necessary

Answer

Ignore the conversation since it involves only healthcare workers

Answer

Join the conversation to gather clinical context

Answer

Write down the patient information in case it is needed clinically later

Question 4

Under HIPAA, what must a covered entity do when a data breach affects 500 or more individuals?

Accepted Answer

Notify affected individuals, provide notice to prominent media outlets in affected states, and report to HHS (OCR) within 60 days of breach discovery

Answer

File a report only with local law enforcement within 10 days

Answer

Notify affected individuals within 1 year of discovery at their convenience

Answer

Report only to the state health department within 90 days

Question 5

A patient requests that the medical office NOT share their PHI with their health insurance plan for a specific service they paid for entirely out of of-pocket. Under HIPAA, what must the covered entity do?

Accepted Answer

Honor the restriction request — this is a mandatory restriction covered entities must comply with under the HITECH Act

Answer

Inform the patient this is not possible under HIPAA regulations

Answer

Comply only if the patient submits the request in writing notarized by an attorney

Answer

Comply only if the treating physician agrees the restriction is appropriate

Question 6

Which federal law supplements HIPAA by providing additional privacy protections specifically for substance use disorder (SUD) treatment records?

Accepted Answer

42 CFR Part 2 (Confidentiality of Substance Use Disorder Patient Records)

Answer

The Americans with Disabilities Act (ADA)

Answer

The Family and Medical Leave Act (FMLA)

Answer

The Mental Health Parity and Addiction Equity Act (MHPAEA)