CSP Regulatory Compliance 3 — Questions and Answers
Question 1: Under the HIPAA Breach Notification Rule, a breach affecting more than 500 residents of one state requires notifying which party in addition to the individuals and HHS?
- The state attorney general only
- The drug manufacturer
- The patient's prescriber
- Prominent media outlets serving that state (Correct answer)
Correct answer: Prominent media outlets serving that state
Breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets in that area.
Question 2: What is the outside deadline for notifying affected individuals of a breach of unsecured PHI under HIPAA?
- No later than 60 calendar days after discovery (Correct answer)
- No later than 10 business days after discovery
- No later than 90 days after discovery
- By the end of the calendar year
Correct answer: No later than 60 calendar days after discovery
Notice must be given without unreasonable delay and no later than 60 calendar days after discovery of the breach.
Question 3: A specialty pharmacy contracts with an outside vendor to run its patient refill-reminder calls using PHI. What document is required under HIPAA?
- Data Use Agreement
- Business Associate Agreement (Correct answer)
- Notice of Privacy Practices
- Patient authorization for each call
Correct answer: Business Associate Agreement
A vendor that creates, receives, or transmits PHI on behalf of a covered entity is a business associate and requires a BAA.
Question 4: Which federal regulation adds confidentiality protections beyond HIPAA for records from federally assisted substance use disorder treatment programs?
- 21 CFR Part 11
- 45 CFR Part 46
- 42 CFR Part 2 (Correct answer)
- 21 CFR Part 1306
Correct answer: 42 CFR Part 2
42 CFR Part 2 restricts disclosure of SUD treatment records from federally assisted programs, which is stricter than HIPAA.
Question 5: Under HIPAA, within how many days must a covered entity generally act on a patient's request to access their PHI?
- 15 days with no extension
- 45 days
- 60 days
- 30 days, with one 30-day extension allowed (Correct answer)
Correct answer: 30 days, with one 30-day extension allowed
The Privacy Rule requires action within 30 days, with one 30-day extension if the individual is notified in writing.
Question 6: The HIPAA minimum necessary standard does NOT apply to which disclosure?
- PHI disclosed to a treating provider for treatment (Correct answer)
- PHI shared with a payer for a prior authorization
- PHI given to a business associate for billing
- PHI used internally for quality audits
Correct answer: PHI disclosed to a treating provider for treatment
Disclosures to or requests by a health care provider for treatment purposes are exempt from the minimum necessary standard.
Question 7: Under the HIPAA Safe Harbor method, how is PHI de-identified?
- Encrypting the entire record with AES-256
- Removing the 18 specified identifiers with no actual knowledge that the rest could identify the person (Correct answer)
- Replacing names with initials
- Getting written patient consent
Correct answer: Removing the 18 specified identifiers with no actual knowledge that the rest could identify the person
Safe Harbor requires removing 18 listed identifiers, with no actual knowledge that the remaining data could identify the individual.
