Medical Law and Ethics Module 6 Quiz

Larry visited the HIM department at his local hospital and requested an accounting of disclosure for his health records. He was informed that the organization has 60 days to provide the information to him. After 60 days, Larry was told that the organization is unable able to comply with the original request within the designated timeframe. How much extension time is permissible for the accounting of disclosure? 30 days 45 days 60 days 90 days

30 days

True or False? The Notice of Privacy Practice (NPP) does not have an effective date noted on the form. True False

False

True or False? The covered entity provides a Notice of Privacy Practices to every individual requesting information in multiple languages common to the area. True False

True

Sharon was recently in the hospital for a colectomy and now has a colostomy in place. Her physician is providing additional care but happens to be located in a different town than the hospital where she had her procedure. She contacted the hospital's HIM department and requested copies of her medical records. After receiving the copies and reviewing them, she will be taking them to her physician's office for continued care. Which HIPAA component applies to this scenario? Amendment Access and Copies Restrictions Accounting of Disclosures

Access and Copies

The hospital hired a records release company to handle all release of information requests including paper and electronic records. The hospital received a request for records from Nicole and forwarded this request to the records release company. The company copied Nicole's records, prepared them to be sent, and included a bill in the envelope with the records. When Nicole received the bill, she was upset that she must pay for information that she considers her property. Nicole went to the hospital to speak with the records release employee. The employee explained that the charge is permissible as it is a reasonable cost. Which of the following are included in the reasonable cost of records? Select all that apply. Certain Labor Supplies Telephone calls Postage

Certain Labor Supplies Postage

Ron lives in a state where marijuana is legal. He works for the federal government where drug use, including marijuana, is not permitted. In a random drug test, he tests positive for marijuana use and is terminated from his position. Which law will determine the outcome for Ron? Business law Federal law County law State law

Federal law

An HIM director receives a request from the FBI for information about a patient's treatment. This patient made threats to the President and ended up in the hospital due to injuries from poison that he was preparing to send to the White House. As a result, this patient was identified as a security risk. The HIM director disclosed the information to the FBI. When the patient's attorney asked for an accounting of disclosure for the patient's health information, the disclosure to the FBI was not included. What determines information that is included and not included in the accounting of disclosure? ARRA HITECH HIPAA Privacy Rule EMTALA

HIPAA Privacy Rule

A lab technician looked up his neighbor's health information because he is curious about why he was admitted to the hospital. He learned that his neighbor was diagnosed with cancer and shared this information with his wife. What type of breach occurred? Unintentional breach Intentional breach This breach is considered to be both unintentional and intentional This is not a breach

Intentional breach

While in the hospital, Mark was diagnosed with overdose of multiple medications. After yelling and throwing things at the nurses and other staff, Mark's behavior was labeled as uncooperative. This led to his admittance to the hospital for further care and provision of medications to help Mark's system clear the overdose. Mark began making statements that he would kill himself after being discharged. When the nursing staff alerted the hospitalist, the hospitalist ordered the hospital psychiatrist to visit Mark. After reviewing Mark's case, the psychiatrist talked with Mark and determined that he has Bipolar I disorder and is significantly depressed. Mark underwent treatment and continues to see the psychiatrist even after being discharged from the hospital. The psychiatrist made his own psychotherapy notes separate and apart from the hospital record. Mark returned to the hospital and requested a copy of his records from the HIM department. Will Mark be allowed access to his psychotherapy notes? Why or why not? Yes; The psychotherapy notes are included in the medical record. No; A summary of the psychotherapy notes will be released instead. No; Mark needs to contact the psychiatrist directly. Yes; The psychotherapy notes will be released in 30 days.

No; A summary of the psychotherapy notes will be released instead.

The HIPAA Privacy Rule includes provisions to allow individuals control over the use and disclosure of their health information. What will be provided to the individual as an explanation for how their health information will be used? HITECH Privacy Practice Notice of Privacy Practices Notice of Documentation Accounting of Disclosure

Notice of Privacy Practices

The IT staff at St. Mary's discovered a widespread data breach within their billing department that occurred as a result of the failure of encryption software. Highly sensitive patient data for 800 patients including names, addresses, birthdates, social security numbers, and financial information was potentially compromised. To remain in compliance of breach notification, what are the next steps that the organization needs to take? Select all that apply. Notice to Media Notice to the Secretary of HHS Notice to Information Technology Notice to the Individual

Notice to Media Notice to the Secretary of HHS Notice to the Individual

Patients are entitled to review the accounting of disclosure. After learning of her right to do so, Sally requested that the hospital send her the official accounting of where her health information had been released. What instance of disclosure will not be included? Select all that apply. Receiving a copy of her own records Continuity of care Storage of health records off site Signed release of information

Receiving a copy of her own records Continuity of care Signed release of information

The Director of HIM is preparing her staff to begin purging paper records from the HIM department. Her staff has questions about purging some of the records. In order to determine retention rules, she refers to the HIPAA Privacy Rule and the applicable state law. The HIPAA Privacy Rule states that the records must be retained for six years from the date of last service. However, the state law requires records to be retained for a period of at least 10 years from the last date of service. Which retention rule should the HIM director follow? State law Federal law HIPAA Privacy Rule State retention rules

State law

Susan works in the Quality department at the local hospital and is responsible for bringing reports to a medical staff meeting. These reports contain identifiable patient information. Last week, Susan organized the reports on a flash drive. On her way to the meeting, she stopped at the cafeteria and set the flash drive down. A few minutes later, Susan arrived at the meeting and realized that she no longer had the flash drive. She returned to the cafeteria but discovered that the flash drive was gone. What type of breach is described in this scenario? Unintentional Intentional Encryption Release

Unintentional

John works for a group of physicians and is setting up laptops for their office. He is using a flash drive that contains patient identifiers including names, addresses, social security numbers, and birthdates. At some point, John lost the flash drive and has no idea where it might be. John informs his IT department that the information was not encrypted. What questions in the risk assessment will John and his IT department have to answer in order to determine whether or not this is a reportable breach? Select all that apply. Who accessed the PHI? Was the PHI acquired? Was PHI was involved? Why was the drive lost?

Who accessed the PHI? Was the PHI acquired? Was PHI was involved?