Questions and Answers
The Office for Civil Rights (OCR) is the entity that oversees HIPAA, and the agency's goal is to ensure that patients' health information is properly protected while allowing for the flow of health information needed. OCR also provides excellent guidance on steps to take if an entity experiences a cyberattack.
True
A cyberattack could result in negative press against the organization and lack of trust from patients. It could also result in a privacy breach, which puts patients at risk for identity theft and other fraudulent activity.
True
If disclosing PHI to legal authorities/government/public officials, CE must verify identity, for instance asking for a government badge/ID, credential, or some proof of government status.
True
How are computerized data medical records destroyed?
Signup and view all the answers
Covered entities participating in an Organized Health Care Arrangement are permitted to:
Signup and view all the answers
In cases where CE is making fundraising communications to individuals, the individual must be provided with an opportunity to object/elect to receive such communications.
Signup and view all the answers
Covered entities can use or disclose PHI by these 4 areas: 1. for treatment, payment, healthcare operations (TPO), 2. for public interest in disaster relief or public emergency, 3. with an opportunity to _____, 4. with authorization granted.
Signup and view all the answers
What are covered entities?
Signup and view all the answers
What is a Controlling Health Plan (CHP)?
Signup and view all the answers
What should you do with a 'required' implementation specification?
Signup and view all the answers
What should you do with an 'addressable' implementation specification?
Signup and view all the answers
What does a Designated Record Set (DRS) include?
Signup and view all the answers
What records are excluded from the Designated Record Set (DRS)?
Signup and view all the answers
How are DVD medical records destroyed?
Signup and view all the answers
Give examples of use or disclosure of PHI other than treatment, payment, and healthcare operations (TPO).
Signup and view all the answers
Give examples of administrative safeguards.
Signup and view all the answers
Give examples of physical safeguards.
Signup and view all the answers
Give examples of technical safeguards.
Signup and view all the answers
What are the key differences between HIPAA 'consent' and 'authorization'?
Signup and view all the answers
What is the primary difference between HIPAA authorization and Right of Access regarding disclosure?
Signup and view all the answers
What is excluded from the Right of Access?
Signup and view all the answers
What are the ranges of HIPAA Civil Penalties?
Signup and view all the answers
What are the ranges of HIPAA Criminal Penalties?
Signup and view all the answers
What makes it a criminal offense under HIPAA?
Signup and view all the answers
How long must a covered entity maintain written records according to the Security Rule documentation requirements?
Signup and view all the answers
What is the purpose of HIPAA?
Signup and view all the answers
HIPAA resides in which CFR section?
Signup and view all the answers
What are the subparts of HIPAA part 164?
Signup and view all the answers
How do you determine if an organization is a 'Covered Entity'?
Signup and view all the answers
What Act established restrictions on how government can share personal information?
Signup and view all the answers
Which of the following is not considered a HIPAA Entity Designation?
Signup and view all the answers
What is the Gramm-Leach-Bliley Act (GLBA)?
Signup and view all the answers
What is an OHCA?
Signup and view all the answers
What is an ACE?
Signup and view all the answers
What is a Hybrid Entity?
Signup and view all the answers
What is defined as the transmission of information between two parties for health care activities?
Signup and view all the answers
What are examples of a BA?
Signup and view all the answers
A hospital is not required to have a business associate contract with the specialist to whom it refers a patient.
Signup and view all the answers
Business Associates After HITECH are directly responsible for HIPAA compliance.
Signup and view all the answers
Under HIPAA, individuals identified as business associates are obligated to enter into a business associate agreement.
Signup and view all the answers
Except for TPO, list two examples where a CE requires an authorization to use/disclose PHI.
Signup and view all the answers
How do you determine if an entity is subject to HIPAA?
Signup and view all the answers
What is referred to when HIPAA provides standards that states can add to?
Signup and view all the answers
What is the intent of HIPAA?
Signup and view all the answers
A physician is required to have a business associate contract with a laboratory when disclosing protected health information.
Signup and view all the answers
A hospital laboratory is required to have a business associate contract to disclose PHI to a reference laboratory.
Signup and view all the answers
Research use/disclosure with individual authorization does not expire until the end of the research study.
Signup and view all the answers
Research use/disclosure with individual authorization can be combined with other consents for participation in research.
Signup and view all the answers
A program providing both SUD services and Mental Health Services will have records subject to Part 2 regulations.
Signup and view all the answers
What are the 4 federal regulations/government agencies that govern the privacy of individually identifiable information in research?
Signup and view all the answers
Certificates of Confidentiality (CoC) protect the privacy of human research participants enrolled in sensitive research. This is authorized by which act?
Signup and view all the answers
What is a system of records notice (SORN)?
Signup and view all the answers
What is a research IRB?
Signup and view all the answers
An individual must authorize these marketing communications before they can occur, except:
Signup and view all the answers
When contracting with payers, they must follow HIPAA security and privacy rules.
Signup and view all the answers
Which of the following requires a Business Associate contract?
Signup and view all the answers
Is a covered entity required to provide notice to individuals about its disclosures of PHI to a public health authority?
Signup and view all the answers
OHCAs and ACEs are able to produce a joint Notice of Privacy Practice (NPP).
Signup and view all the answers
Since your blog is private, you are not in violation of HIPAA regulations by posting a picture of patients.
Signup and view all the answers
In the mid-1990s, OIG began to require providers settling civil health care fraud cases to enter into specific type of agreements as a condition for OIG not pursuing exclusion. These agreements are referred as:
Signup and view all the answers
What are some of the key basic elements to contracts?
Signup and view all the answers
The privacy professional must ensure that the contract supports the privacy profile in vendor relations.
Signup and view all the answers
Which of the following doesn't fall under the circumstances for a Covered Entity to deny an individual access to their PHI?
Signup and view all the answers
38 U.S.C. 7332 deals with confidentiality of patient medical record information related to:
Signup and view all the answers
The Minimum Necessary is a key concept under the HIPAA security rule.
Signup and view all the answers
Is there any information we can release to a person who is calling on behalf of a patient who is not authorized in a release form?
Signup and view all the answers
How do we validate the request for PHI from lawyers?
Signup and view all the answers
A long-term dental patient's PHI can be requested and fulfilled without authorization for purposes of treatment.
Signup and view all the answers
You may report suspected domestic violence without the patient's authorization.
Signup and view all the answers
What is ARRA also known for?
Signup and view all the answers
What does IIHI stand for?
Signup and view all the answers
What does PHI stand for?
Signup and view all the answers
What is de-identified information?
Signup and view all the answers
What is re-identification?
Signup and view all the answers
What does Minimum Necessary refer to?
Signup and view all the answers
The Minimum Necessary rule does not apply to which of the following?
Signup and view all the answers
How does the Minimum Necessary concept link to the Security Rule?
Signup and view all the answers
Who can deceased individuals' information be released to at any time?
Signup and view all the answers
What does preemption under HIPAA mean?
Signup and view all the answers
What are the valid authorization core elements?
Signup and view all the answers
What are the valid authorization 3 key statements?
Signup and view all the answers
The three types of AUTHORIZATION: VALID - must have all the 6 required core elements and 3 statements/notices; D_______ - lacks any of the required elements/statements, or expiration date has passed, or revoked, etc.; C_______ - typically allowed in research studies, this authorization may be combined with another written permission IF it's for the same research related studies.
Signup and view all the answers
What is Request for Restrictions?
Signup and view all the answers
What is Request for Confidential Communication?
Signup and view all the answers
Which subpart of HIPAA part 164 sets limits on how PHI can be used and shared with others?
Signup and view all the answers
What is the difference between HIPAA security and privacy?
Signup and view all the answers
45 CFR 164 - Subpart C outlines the three safeguards to ensure the _____, ____, ____ of ePHI.
Signup and view all the answers
What are the Research HIPAA Waiver criteria?
Signup and view all the answers
What is malicious software?
Signup and view all the answers
A covered entity may use or disclose PHI for TPO. What does TPO stand for?
Signup and view all the answers
Payer/health plans are allowed to use/disclose beneficiaries' PHI in activities such as legal services, medical review, and fraud detection.
Signup and view all the answers
Which is the correct method of releasing PHI to the Social Security Administration for benefits application?
Signup and view all the answers
The American Recovery and Reinvestment Act is also known as?
Signup and view all the answers
C.I.A. (HIPAA) stands for?
Signup and view all the answers
What comprehensive legislation ensures access to health coverage for those who change jobs?
Signup and view all the answers
The HIPAA Privacy and Security rules were established to create a national health care privacy and security standard.
Signup and view all the answers
Study Notes
HIPAA Overview
- HIPAA's purpose includes protecting protected health information (PHI) from unauthorized access and ensuring privacy.
- It aims to prevent fraud, simplify administrative processes, and standardize electronic billing in healthcare.
HIPAA Regulations
- HIPAA regulations are found in 45 CFR sections 164.102 to 164.534.
- Key subparts include:
- Subpart A: General Rules
- Subpart C: Security
- Subpart D: Breach Notification
- Subpart E: Privacy
Covered Entities and Transactions
- Covered Entities (CE) include healthcare providers, health plans, and clearinghouses that electronically transmit health information.
- Defined healthcare transactions include health claims, eligibility checks, and payment advice.
Business Associates and Responsibilities
- A Business Associate (BA) performs functions on behalf of a CE and has access to PHI.
- Business associates are directly responsible for HIPAA compliance post-HITECH, regardless of existing contracts.
Organizational Structures
- An Organized Health Care Arrangement (OHCA) facilitates integrated care among multiple providers.
- Affiliated Covered Entities (ACE) consist of legally separate entities that share control but do not integrate their delivery systems.
Compliance and Authorizations
- Use and disclosure of PHI for treatment, payment, and operations (TPO) typically do not require specific authorization.
- Situations requiring authorization include marketing and psychotherapy notes.
Specific Regulations and Acts
- The Privacy Act of 1974 restricts how government agencies share personal information, necessitating a System of Records Notice (SORN) for new data collections.
- The Gramm-Leach-Bliley Act (GLBA) mandates the protection of customer financial information.
Research Considerations
- Research activities involving PHI must comply with HIPAA and be reviewed by Institutional Review Boards (IRBs).
- Certificates of Confidentiality protect sensitive research participant data under the Public Health Service Act.
Marketing and Public Disclosure
- Covered entities must notify individuals about PHI disclosures, while business associates are not required to provide notices for health information they handle.
- Hospitals and providers can communicate about services without being classified as engaging in marketing activities if no remuneration is involved.
Contractual Obligations
- Contracts establish the exchange of services and remedies for breaches. Key elements of contracts include offer and acceptance.
- Business Associate Agreements (BAAs) are required for independent medical transcriptionists and other BAs handling PHI.
Miscellaneous Facts
- Certain healthcare functions may not require a BAA when sharing PHI among providers for TPO.
- Part 2 regulations for Substance Use Disorder (SUD) services provide additional protections beyond HIPAA.### Contractual Elements
- Capacity to Contract: Ensure parties can perform services; request proof and biographies of staff involved in critical services.
- Consideration: Clearly define remuneration within the contract.
- Legal Purpose: Establish legal requirements and responsibilities for subcontractors and measures.
- Legality of Form: Utilize precise legal language and clauses to ensure compliance.
- Intention to Create Legal Relations: Include explicit statements of intent to be legally bound by the contract.
- Consent to Contract: Obtain required signatures from all parties involved.
- Mistakes and Undue Influence: Outline alternative options if issues arise during contract fulfillment.
Vendor Relations and Privacy
- Privacy professionals must ensure contracts align with the privacy profile and outline privacy impacts, mandates, and remedies.
HIPAA Regulations
- An individual may be denied access to their PHI under certain circumstances; psychotherapy notes are not among them.
- 38 U.S.C. 7332 pertains to confidentiality of medical records related to drug abuse, alcoholism, HIV, and sickle cell anemia.
- Minimum Necessary concept is critical under the Privacy Rule, not the Security Rule.
- Patients can request restrictions on use and disclosure of their information.
HIPAA Authorization and Guidelines
- Valid HIPAA authorizations must include core elements such as the description of information to be disclosed and requisite signatures.
- Three key statements include the right to revoke authorization and potential for re-disclosure of information.
- Authorization validity types: Valid, Defective (lacks required elements), and Compound (for combined research studies).
Privacy and Security in Health Information
- TPO stands for Treatment, Payment, and Health Care Operations, allowing disclosure without patient authorization in certain situations.
- HIPAA includes both privacy (covers all forms of PHI) and security (focused on electronic PHI).
- Covered Entities must verify identity when disclosing PHI to legal or government officials.
Controlled Health Plans and Specifications
- Controlling Health Plans oversee their own actions and those of subordinate plans; relevant in Medicaid contexts.
- Implementation specifications are categorized as "required" (must be implemented as stated) or "addressable" (can be adjusted if not reasonable).
Designated Record Set (DRS) Definition
- DRS includes medical records, billing data, and other records used to make decisions about individuals; excludes administrative data and quality assurance reports.
Breach Notification and Cybersecurity
- ARRA mandated breach notification provisions under HITECH and aimed to promote health information technology.
- Cyberattacks pose risks to patient privacy, clinical outcomes, and organizational reputation, necessitating robust cybersecurity measures.### Destruction of Medical Records
- DVD medical records must be destroyed through shredding and cutting.
Use or Disclosure of PHI
- Examples beyond Treatment, Payment, and Healthcare Operations (TPO) include:
- Public health interests
- Research purposes
- Serious threats to health or safety
- Organ or tissue donation involving decedent information
- Worker’s compensation claims by insurers
Administrative Safeguards
- Key components include:
- Development of policies and procedures
- Providing training and education
- Designating individuals responsible (e.g., Security Officer)
- Implementing contingency planning
Physical Safeguards
- Important measures consist of:
- Establishing facility security or access plans
- Ensuring proper disposal processes and media reuse
- Regular data backup and secure storage solutions
Technical Safeguards
- Essential tools and practices include:
- Utilizing passwords for access control
- Implementing encryption for data protection
- Enforcing automatic log-off features
- Assigning unique user identification for accountability
HIPAA Consent vs. Authorization
- Consent for TPO is voluntary, while authorization is mandated by the Privacy Rule for PHI use and disclosure.
HIPAA Authorization vs. Right of Access
- Authorization allows permitted disclosures of PHI, whereas the Right of Access mandates required disclosures.
Exclusions from Right of Access
- Information not included in the Right of Access:
- Any content not part of the Designated Records Set
- Psychotherapy notes
- Records collected for anticipated legal proceedings (civil, criminal, or administrative)
HIPAA Civil Penalties
- Civil penalties for non-compliance range from:
- $100 for cases of ignorance to $50,000 for severe violations
- $1,000 to $50,000 for reasonable cause
- $10,000 to $50,000 for willful neglect corrected within 30 days
- $50,000 for willful neglect not corrected; maximum annual penalty of $1.5 million
HIPAA Criminal Penalties
- Criminal penalties include:
- Up to 1 year in prison and a $50,000 fine for knowingly committing offenses
- Up to 5 years and a $100,000 fine for offenses under false pretense
- Up to 10 years and a $250,000 fine for offenses committed with intent to harm or for personal gain
Criminal Offenses Under HIPAA of 1996
- Submission of claims based on incorrect codes or medically unnecessary services is considered a criminal offense, risking exclusion from government healthcare programs.
Security Rule Documentation Requirements
- Covered entities must maintain written records for a minimum of 6 years from the record creation date or its effective date.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Dive into vital concepts of HIPAA and its role in protecting patient health information. This quiz provides a comprehensive overview of the Health Care Compliance Association's certification topics, ensuring you're well-prepared for your CHPC exam.