Deck 7: Privacy Law and Hipaa

Question 1

Answer the following questions in the spaces provided.
Patient complaints about privacy must be directed to which government agency?
______________________________________________

Answer 1

HIPAA (The Health Insurance Portability and Accountability Act) was introduced in the year 1996 by the government to protect the sensitive date related to patients using sets of standard principles.
Patient complaints about privacy must be directed to: Department of Health and Human Services have been made authorized body to investigate the complaints related to the violation of HIPAA regulations. This department is a part of the country's federal government and works on a goal of protecting the health of all the citizens by offering required human health services. However, it is the federal security agency that looks after the violation of the privacy rights acquired by the patients. This agency processes every complaint received from the patients' side against the healthcare providers not protecting the privacy of their health information and medical treatment.

Question 2

Answer the following questions in the spaces provided.
If a state law and HIPAA's federal law disagree, which law should you follow?
___________________________________________________________________________

Answer 2

HIPAA (The Health Insurance Portability and Accountability Act) was introduced in the year 1996 by the government to protect the sensitive date related to patients using sets of standard principles.
When there is a difference in the opinions and laws enacted by the state law and the HIPAA's law, then one should follow the HIPAA's law. This is because HIPAA law is a federal law and it regulates and governs all the states falling in the country's jurisdiction. The provisions given under the HIPAA law are applicable over all the states and are considered as higher than any state law. This is the reason why one should follow the HIPAA law when there is a disagreement between state law and HIPAA law because HIPAA law is greater than state law owing to its federal recognition.

Question 3

Circle the correct answer for each of the following multiple-choice questions. Circle the letter for the statement that is not true of HIPAA:

A) HIPAA requires that health care practitioners change a medical record if a patient complains.
B) If a patients asks to see his or her medical record, the request must be honored.
C) Health care practitioners must supply patients who ask with a list of those who have received copies of the patient's medical record.
D) Under HIPAA, any health care facility that transmits protected health information electronically is a covered entity.

Answer 3

HIPAA (The Health Insurance Portability and Accountability Act) was introduced in the year 1996 by the government to protect the sensitive date related to patients using sets of standard principles.
The correct answer is: This is because since HIPAA was implemented, Department of Health and Human Services have been made authorized body to investigate the complaints related to the violation of HIPAA regulations. This department is a part of the country's federal government and works on a goal of protecting the health of all the citizens by offering required human health services. This department ensures that the recording of medical information of the patient takes place in a genuine manner, and there is no manipulation made in the medical history no matter even when the patient requests for the changes in his medical records.
However, options b, c, and d are incorrect because under HIPAA, patients are rightful to see and obtain their medical records, and they are also allowed to obtain the list of patients who have obtained their medical records from the healthcare practitioner. Similarly, HIPAA regulates and administers its regulation over hospitals and medical centers that records the patients' information electronically, and considers them as a covered entity.

Question 4

Use your critical-thinking skills to answer the questions that follow each of the case studies.
Shirley, an EMT, is off duty and is driving her private vehicle on the interstate in a snowstorm. The car ahead of Shirley hits an icy patch and skids off the road, overturning as it hits the ditch. Shirley stops to help and dials 911 on her mobile phone. The lone woman in the wrecked car has scratches and bruises and an obviously broken arm. While Shirley is helping the woman, a news van stops and a television reporter films the wreck for the evening news. The injured driver refuses to answer questions, so the reporter turns to Shirley, who knows the injured driver's name.
Rescue services arrive while the television reporter is there. Can the ambulance attendants, who are also EMTs, tell the television reporter the apparent extent of the woman's injuries? Why or why not?
______________________________________________________________

Question 5

Distinguish between covered entities and covered transactions.
________________________________________________________________________________
________________________________________________________________________________

Question 6

ETHICS ISSUE 1: HIPAA has made it illegal, under threat of penalty, for health care practitioners to disclose confidential health information about patients to unauthorized sources.
Sharon, a second-year nursing student, is completing a surgical rotation in a community hospital. At the breakfast table, Sharon's husband asks her to find out what is wrong with one of his employees, who has been hospitalized for several days. He is interested in knowing when the man may be able to return to work. Is it ethical for Sharon to give her husband this information? Explain your answer.
________________________________________________________________________________
________________________________________________________________________________

Question 7

ETHICS ISSUE 3: Some sources distinguish between privacy in health care and confidentiality. According to Harman, privacy refers to the right of an individual to be let alone and to the fact that patients must authorize release of information. Confidentiality refers to limiting disclosure to authorized persons and ensuring protection of records documenting communication between providers and patients.
With the implementation of HIPAA, the extensive federal law mandating certain privacy and security precautions, is privacy for protected health information now guaranteed? Explain your answer.
________________________________________________________________________________
________________________________________________________________________________

Question 8

Use your critical-thinking skills to answer the questions that follow each of the case studies.
You are a nurse and a teenaged patient's mother tells you she wants access to her daughter's medical records.
What will you do?
______________________________________________________________
______________________________________________________________

Question 9

Answer the following questions in the spaces provided.
Which federal government agency deals with compliance and implementation of the National Identifier Standard?
_________________________________________________________________

Question 10

Answer the following questions in the spaces provided.
The primary reason for the Security Rule is
___________________________________________________________________________

Question 11

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
The HIPAA-mandated standard for electronic transmissions.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 12

Complete the activities and answer the questions that follow.
In 2007, medical records of two celebrities-George Clooney and Paris Hilton-were leaked to the press by health care employees who had access to the records. Visit the Web site at http://inside.duke.edu/article.php?IssueID=38 ParentID=1384. Read the article and answer the following questions:
What is the correct answer to the ethical question posed at the beginning of the article? Why is this the correct answer?
Take the HIPAA quiz at the above-listed Web site, under "Get Hip on HIPAA," and report your answers below or in class.
________________________________________________________________________________
________________________________________________________________________________

Question 13

Give two examples of a covered entity.
________________________________________________________________________________
________________________________________________________________________________

Question 14

ETHICS ISSUE 2: HIPAA requires health care providers to issue privacy notices to patients.
You are the medical office employee responsible for giving patients your employer's privacy notice. Even though you have explained why an elderly patient has been given the privacy notice, he complains about yet another "health care form" and refuses to read it. How will you respond?
________________________________________________________________________________
________________________________________________________________________________

Question 15

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
A valid reason to disclose protected health information.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 16

Complete the activities and answer the questions that follow.
Visit www.hhs.gov/faq/. Access "Frequent Questions," select number 2, and choose a category. Prepare a list of 10 questions you would most like to have answered. List the answers to the questions you have chosen.
________________________________________________________________________________
________________________________________________________________________________

Question 17

Answer the following questions in the spaces provided.
What is the determining factor in deciding whether or not health care providers are considered covered entities under HIPAA?
____________________________________________________________________
____________________________________________________________________

Question 18

Circle the correct answer for each of the following multiple-choice questions. A business associate is

A) A person, group, or organization outside the medical practice that has a HIPAA-approved reason to see protected health information.
B) A health care practitioner's financial advisor.
C) Anyone who sells products related to health care.
D) None of the above

Question 19

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
This person evaluates, manages, and reports on the security of a health provider's electronic data.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 20

Give two examples of covered transactions.
________________________________________________________________________________
________________________________________________________________________________

Question 21

ETHICS ISSUE 3: Some sources distinguish between privacy in health care and confidentiality. According to Harman, privacy refers to the right of an individual to be let alone and to the fact that patients must authorize release of information. Confidentiality refers to limiting disclosure to authorized persons and ensuring protection of records documenting communication between providers and patients.
Why are privacy and confidentiality so important to patients and to health care practitioners?
________________________________________________________________________________
________________________________________________________________________________

Question 22

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
Networks closed to the Internet that are provided by the telephone company.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 23

Answer the following questions in the spaces provided.
What is an electronic transmission , and how and why does HIPAA address it?
___________________________________________________________________________
___________________________________________________________________________

Question 24

Circle the correct answer for each of the following multiple-choice questions. You could unintentionally expose content on your personal computer or your employer's system network by

A) Shopping on the Internet while you are at work.
B) Downloading games from the Internet.
C) Sending and receiving unsecured e-mails to and from friends.
D) All of the above

Question 25

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
Covered entities.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 26

Define state preemption.
________________________________________________________________________________
________________________________________________________________________________

Question 27

Circle the correct answer for each of the following multiple-choice questions. If a patient complains that his privacy was breached, what should you ask that he do?

A) Call a lawyer.
B) Speak to your privacy officer to try to handle the complaint in the office.
C) Immediately file a complaint with the Office for Civil Rights.
D) Discuss the problem with someone else in the office.

Question 28

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
Covered transactions.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 29

Answer the following questions in the spaces provided.
What is the primary objective of Administrative Simplification?
___________________________________________________________________________
___________________________________________________________________________

Question 30

Circle the correct answer for each of the following multiple-choice questions. Which of the following are the privacy officer's responsibilities?

A) Researching the Privacy Rule.
B) Helping to develop the Notice of Privacy Practices.
C) Training staff on privacy policies and procedures.
D) All of the above

Question 31

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
Refers to providing only as much patient information as needed for a request or to conduct health care business.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 32

Briefly summarize the four HIPAA standards.
________________________________________________________________________________
________________________________________________________________________________

Question 33

Circle the correct answer for each of the following multiple-choice questions. Which of the following is not covered by HIPAA's Security Rule?

A) The content of all documents pertaining to patient privacy.
B) Maintaining electronic security for networked computers.
C) Using HIPAA standards for electronic transmission of protected health information.
D) None of the above

Question 34

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
One of two types of PHI access mandated by HIPAA.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 35

Answer the following questions in the spaces provided.
Which of the four HIPAA Standards addresses Administrative Simplification?
___________________________________________________________________________
___________________________________________________________________________

Question 36

Circle the correct answer for each of the following multiple-choice questions. Which of the following is not considered marketing under HIPAA provisions?

A) A pharmaceutical company wants to send special mailings to a provider's diabetic patients to announce a new blood sugar testing device.
B) A reminder to female patients when their mammograms should be scheduled.
C) Cholesterol screening results sent to patients through the mail.
D) None of the above.

Question 37

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
One of a patient's six rights mandated by HIPAA.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 38

Which of the four standards is most concerned with confidentiality of medical records?
________________________________________________________________________________
________________________________________________________________________________

Question 39

Circle the correct answer for each of the following multiple-choice questions. Which of the following is not a violation of HIPAA's Privacy Rule?

A) You call across a crowded waiting room to tell a patient he has forgotten his prescription for dilantin, a drug used to control seizures.
B) You are a medical assistant for a physician's private practice, and you tell a friend, who is a bank teller, that a mutual friend has seen your employer and is pregnant.
C) A telephone caller identifies himself as an insurance plan representative and requests PHI. You do not know the caller, but you comply.
D) All of the above are violations of HIPAA's Privacy Rule.

Question 40

Match each description that follows with the correct answer by writing the appropriate letter in the space provided.
To remove patient-identifying information from PHI.
a. File a complaint
b. value-added networks
c. physicians and pharmacists
d. minimum necessary
e. de-identify
f. billing patients and filing insurance claims
g. HIPAA representatives ask to see PHI
h. security officer
i. privacy officer
j. permission
k. electronic data interchange (EDI)

Question 41

Answer the following questions in the spaces provided.
HIPAA stands for
__________________________________________________________________________________

Question 42

Answer the following questions in the spaces provided.
A document that informs patients on how a health care provider intends to use and disclose patient information and also informs patients of their rights is called
___________________________________________________________________________
___________________________________________________________________________

Question 43

Circle the correct answer for each of the following multiple-choice questions. An unauthorized person (a computer hacker) manages to access the computers in the hospital where you work and downloads information. Who is the most likely person to handle the disaster?

A) The privacy officer.
B) The hospital administrator.
C) The security officer.
D) The medical records supervisor.

Question 44

ETHICS ISSUE 3: Some sources distinguish between privacy in health care and confidentiality. According to Harman, privacy refers to the right of an individual to be let alone and to the fact that patients must authorize release of information. Confidentiality refers to limiting disclosure to authorized persons and ensuring protection of records documenting communication between providers and patients.
The health care practitioners listed below have followed the letter of HIPAA law. Have they also acted ethically? Explain why or why not.
A patient asks to see her medical records and a medical office records assistant complies, but slams the records down in front of the patient and mutters about being "too busy" for this service.
A physician does not refuse to see a patient who declares that he will not complete his notification preference form, but his abrupt manner discourages the patient from continuing to see the physician.
________________________________________________________________________________
________________________________________________________________________________
A patient asks for a list of disclosures his physician has made of his health information within the past six years, and he is politely asked to submit his request in writing.
________________________________________________________________________________
________________________________________________________________________________
The person responsible for faxing a patient's protected health information from one physician's office to another sends the information to the wrong fax number.
________________________________________________________________________________
________________________________________________________________________________

Question 45

Name four common points in most federal and state privacy laws.
______________________________________________________________
______________________________________________________________

Question 46

What are the two required disclosures of health care information that HIPAA mandates?
________________________________________________________________________________
________________________________________________________________________________

Question 47

Circle the correct answer for each of the following multiple-choice questions. Which of the following is true under HIPAA?

A) HIPAA language states unequivocally that patients have no standing to sue under the law.
B) Patients must submit complaints to the Secretary of Health and Human Services through the Office of Civil Rights.
C) Only a court of law can hear patient complaints.
D) None of the above

Question 48

Use your critical-thinking skills to answer the questions that follow each of the case studies.
Mona frequently travels for her job, and even when she is in town, she's usually reached most easily on her mobile phone. She has three teenagers at home and doesn't want them to pick up her health care messages. She also wants her medical bills sent to her work address.
What should Mona's health care provider do to accommodate her requests?
______________________________________________________________
______________________________________________________________

Question 49

Answer the following questions in the spaces provided.
The department of the federal government responsible for supervising HIPAA compliance and implementation is ________________________________________________

Question 50

Answer the following questions in the spaces provided.
Protected health information (PHI) refers to
___________________________________________________________________________
___________________________________________________________________________

Question 51

ETHICS ISSUE 1: HIPAA has made it illegal, under threat of penalty, for health care practitioners to disclose confidential health information about patients to unauthorized sources.
What should health care practitioners do when family members or friends ask them for information about others that they have discovered in the course of their employment?
________________________________________________________________________________
________________________________________________________________________________

Question 52

Use your critical-thinking skills to answer the questions that follow each of the case studies.
Lewis received a basketball scholarship to attend college, and he signed a form giving the university health service permission to access his health care records. Lewis now wants to know what is included in his health care records.
What should Lewis's health care provider do?
______________________________________________________________

Question 53

The first federal law to deal thoroughly and explicitly with the privacy of medical records is
______________________________________________________________
______________________________________________________________

Question 54

What information must be included in health care facility privacy notices?
________________________________________________________________________________
________________________________________________________________________________

Question 55

Circle the correct answer for each of the following multiple-choice questions. HIPPA's Privacy Rule protects PHI

A) Only in electronic form.
B) Only in written form.
C) Only in spoken form.
D) In all of the above forms.

Question 56

Use your critical-thinking skills to answer the questions that follow each of the case studies.
Shirley, an EMT, is off duty and is driving her private vehicle on the interstate in a snowstorm. The car ahead of Shirley hits an icy patch and skids off the road, overturning as it hits the ditch. Shirley stops to help and dials 911 on her mobile phone. The lone woman in the wrecked car has scratches and bruises and an obviously broken arm. While Shirley is helping the woman, a news van stops and a television reporter films the wreck for the evening news. The injured driver refuses to answer questions, so the reporter turns to Shirley, who knows the injured driver's name.
May Shirley tell the television reporter the injured woman's name without violating federal law? Why or why not?
______________________________________________________________