9.1

Elizabeth has requested a copy of her PHI from Memorial Hospital. Which of the following is acceptable for Memorial Hospital to charge Elizabeth? a. A reasonable cost-based fee b. It may not charge Elizabeth at all c. It may impose any fee authorized by state statute d. It can charge only for the cost of the paper on which the information is printed

a A reasonable cost-based fee is permitted, but it must be based on actual costs incurred for that request. If state statute permits an individual to be charged more than the HIPAA-permitted reasonable cost-based fee then the state statute is preempted by HIPAA.

Deidentified information: a. Does not identify an individual b. Is information from which only a person's name has been stripped c. Can be constituted later or combined to reidentify an individual d. Is subject to the HIPAA Privacy Rule

a Deidentified information does not identify an individual or provide a reasonable basis to believe the individual could be identified. To be deidentified, information has been removed such that it cannot be constituted later or combined to reidentify an individual. Deidentified information is not subject to the HIPAA Privacy Rule.

Julie wants to review her health records, but she is asking about the Privacy Rule's requirements pertaining to record retention. HIPAA establishes that a patient has the right of access to inspect and obtain a copy of her PHI: a. For as long as it is maintained b. For six years c. Forever d. For 12 months

a HIPAA does not specify a length of time that protected health information (PHI) must be maintained; however, the right of access exists for as long as the PHI exists.

Business associate agreements are developed to cover the use of PHI by: a. The covered entity's employees b. Organizations outside the covered entity's workforce that use PHI to perform functions on behalf of the covered entity c. The covered entity's entire workforce d. The covered entity's janitorial staff

b Organizations outside the covered entity's workforce that use PHI to perform functions on behalf of the covered entity includes the definition of a business associate.

The Privacy Rule extends to protected health information: a. In any form or medium, except paper and oral forms b. In any form or medium, including paper and oral forms c. That pertains to mental health treatment only d. That exists in electronic form only

b The Privacy Rules extends to protected health information in any form or medium, including paper and oral forms

The term minimum necessary means that healthcare providers and other covered entities must limit use, access, and disclosure to the least amount to: a. Retain records needed for patient care b. Accomplish the intended purpose c. Treat an individual d. Perform research

b The minimum necessary standard requires that uses, disclosures, and requests be limited to only the amount needed to accomplish an intended purpose.

The right of privacy: a. Has been granted by the US Constitution b. Has been granted via court decisions c. Does not apply to health information d. Does not exist

b The right of privacy, which does apply to health information, has been granted by court decisions that interpret the US Constitution.

One state's law protects the privacy of health information to a greater extent than HIPAA does. a. The state law will be preempted by HIPAA b. The state law is invalid because it does not provide the same level of protection as HIPAA c. The state law may supersede HIPAA d. The state's law must be consistent with HIPAA

c If state laws provide a lesser degree of protection to health information than HIPAA provides, then state law may be preempted. However, state laws that protect health information to a greater extent than HIPAA may supersede HIPAA.

HIPAA regulations: a. Never preempt state statutes b. Always preempt state statutes c. Preempt less strict state statutes where they exist d. Preempt stricter state statutes where they exist

c Where state statute protects PHI to a lesser degree (is less strict) than HIPAA, that state statute will be preempted by HIPAA. This must be analyzed on a case-by-case basis, so preemption is not automatically granted or denied when HIPAA is analyzed relative to a state statute.

DataSource is a business associate of Davis Health System. An individual who was a patient in the Davis Health System contacts DataSource, requesting an accounting of disclosures and stating that this is his right per the HIPAA Privacy Rule. DataSource: a. Does not have to respond to the patient because it is not a covered entity b. May refer the request to Davis Health System c. Does not have to respond to the patient because this is not a HIPAA individual right d. Must respond to the patient and provide an accounting of disclosures

d Business associates must respond to accounting requests that are made directly to them.

Bob is exercising his HIPAA right to request confidential communications of both Memorial Hospital and TruePlus, his health plan. When asked by both entities how he will handle payments, he declines to provide them with any information. As a result: a. TruePlus must still honor the request b. Only Memorial Hospital may deny the request c. Memorial Hospital must still honor the request d. Both Memorial Hospital and TruePlus may deny his request

d Per the right to request confidential communications, both healthcare providers and health plans may refuse to accommodate the request if the individual does not provide information as to how payment will be handled.

The Privacy Rule applies to: a. Healthcare providers only b. Only healthcare providers that receive Medicare reimbursement c. Only entities funded by the federal government d. Covered entities and their business associates

d The Privacy Rule applies to healthcare providers that conduct transactions electronically, health plans, and healthcare clearinghouses. Together, these constitute covered entities. The Privacy Rule also applies to covered entities' business associates.