HLTHST 314 Modules 9-10

Which of the following best describes how the HIPAA Privacy Rule relates to potentially contradictory state law?

HIPAA creates a federal "floor," for minimum standards of health privacy; states may enact laws that afford greater protections of health privacy.

With regard to the federal HIPAA privacy rule, which of the following statements, if any, is correct?

The privacy rule adopted by HHS does not supersede or preempt state laws that provide a higher level of protection for the privacy of healthcare information.

Which of the following best describes the HIPAA violation at issue in the case involving Idaho State University?

A covered entity disabled the firewall protection on its computer servers, leaving the protected health information of approximately 17,500 patients unsecured for at least 10 months.

Which of the following best describes the HIPAA violation at issue in the case involving Hospice of Northern Idaho?

A laptop containing unencrypted health data was stolen, and the U.S. Department of Health and Human Services, Office of Civil Rights determined that the covered entity had not conducted a risk analysis.

Which of the following would NOT be a covered entity subject to the HIPAA Privacy Rule?

A newspaper which received in the mail an anonymous envelope containing embarrassing private health records of political figure.

Which of the following is NOT "protected health information" under the HIPAA Privacy Rule?

An individual's post to Facebook asking for advice regarding how to treat a rash.

In the HIPAA privacy rule, what is the meaning of "accounting of disclosures"?

An individual's right to find out who has received information from his or her medical record.

Which of the following is a federal law that affects the use or privacy of health information?

Both a. and b.

With regard to state laws about the privacy of healthcare information, which of the following statements is correct?

Both a. and b. are correct

Which of the following is NOT true regarding a clinician's ethical obligation of patient confidentiality, as explained in the Clinical Ethics?

In order to encourage individuals to seek treatment, patient-provider confidentiality must be treated as unlimited and absolute.

Which federal agency is primarily tasked with enforcing the HIPAA Privacy Rule?

The Office of Civil Rights of the U.S. Department of Health & Human Services

In Tarasoff v. Regents of the University of California, the patient had told his therapist that he intended to kill a particular person, and subsequently did so. In a suit by the parents of the victim, what did the state court hold?

The therapist had a duty to take reasonable steps for protection of the intended victim, even though it would have required disclosure of confidential information.

Which of the following best describes the right of a private party to bring a civil lawsuit for damages alleging a covered entity violated the HIPAA Privacy Rule?

There is no private right of action under HIPAA, but an individual harmed by a disclosure of health information in violation of the HIPAA Privacy Rule may bring a tort claim under state law. In such a case a violation of the HIPAA Privacy Rule would typically constitute a violation of the applicable standard of care.

Which of the following best describes the HIPAA violation at issue in the case involving Affinity Health Plan?

When a covered entity returned a photo-copier it had been leasing, the copier still contained protected health information for some 300,000 individuals in its hard-drive, and the U.S. Department of Health and Human Services, Office of Civil Rights determined that the covered entity had failed to include the copier in its risk analysis.

In Clinical Ethics, the authors discuss the ethical dilemmas created in circustances where there may be a justification to share private health information with third parties against the will of the patient. In which of the following cases would the authors of Clinical Ethics recommend that the provider abide by the patient's will and not share or report the private information to a third-party?

Where a 61-year-old man is diagnosed with metastatic prostate cancer, and the patient tells the physician he does not intend to tell his wife about the diagnosis.