Heartland Health Centers Annual HIPAA Quiz

1. When are you free to repeat a patient's private health information that you hear on the job?

A. After you no longer work at the organization

B. After a patient dies

C. If you know the patient would not mind

D. When your job requires it

The only acceptable reason to share PHI is if sharing this information is necessary for the purpose of Treatment, Payment or Healthcare Operations.

Explanation

The only acceptable reason to share PHI is if sharing this information is necessary for the purpose of Treatment, Payment or Healthcare Operations.

2. Which of the following is protected health information under HIPAA?

A. The patient’s address

B. The patient’s allergies

C. The patient’s medical record number

D. All of the above

Each of the above are individually identifiable health information and therefore are considered to be PHI under HIPAA.

Explanation

Each of the above are individually identifiable health information and therefore are considered to be PHI under HIPAA.

3. What question should you ask yourself before looking at health information?

A. Would the patient mind if I looked at this?

B. Do I need to know this to do my job?

C. Can anyone see what I’m doing?

D. Am I curious?

The only acceptable reason to share PHI is if sharing this information is necessary for the purpose of Treatment, Payment or Healthcare Operations.

Explanation

The only acceptable reason to share PHI is if sharing this information is necessary for the purpose of Treatment, Payment or Healthcare Operations.

4. When is the patient's authorization to release information required?

B. When the patient’s condition is discussed with a consulting physician.

C. When information is to be shared among two or more clinicians

D. When information is used for billing a private insurer

Answers b, c and d all relate to Treatment, Payment or Health Care Operations and therefore would not require a release of information

Explanation

Answers b, c and d all relate to Treatment, Payment or Health Care Operations and therefore would not require a release of information

5. Protected Health Information (PHI) only refers to a patient's medical record in which name, address and date of birth are indicated.

True

False

PHI refers to individually identifiable health information, whether electronic, paper or verbal. PHI encompasses information that relates to an individual’s past, present or future physical or mental condition, the provision of health care to the individual or future payment for the provision of health care to an individual. PHI includes many common identifiers, such as name, address, birth date, zip code, photograph, medical record number Social Security Number, etc.

Explanation

PHI refers to individually identifiable health information, whether electronic, paper or verbal. PHI encompasses information that relates to an individual’s past, present or future physical or mental condition, the provision of health care to the individual or future payment for the provision of health care to an individual. PHI includes many common identifiers, such as name, address, birth date, zip code, photograph, medical record number Social Security Number, etc.

6. Which of the following would be a HIPAA violation?

A medical student copying portions of several patients' medical records so she can present the information in a classroom discussion
Telling your husband that his basketball team member came to the clinic today and had an AIDS blood test.
Writing the names of patients who are in the waiting room on a chalk board so that all of the patients will know who is next to be seen.
Having copies of test results that a patient requested in the top tray of a basket on your desk, such that anyone coming to the front desk can see the results.

1, 3, 4

2, 3, 4

All of the activities listed above

None of the activities listed above

1. PHI can only be accessed for the purpose of Treatment, Payment or Healthcare Operations (TPO). The medical student’s presentation in a classroom discussion does not meet the criteria of TPO.
2. PHI can only be accessed for the purpose of Treatment, Payment or Healthcare Operations (TPO), so it would be a serious HIPAA violation for an employee to share PHI with her husband.
3. Since patients’ names are PHI, that information cannot be displayed in a manner that would be visible to anyone who does not meet the TPO criteria.
4. Test results are PHI and cannot be displayed in a manner that anyone who does not meet the TPO criteria could see

Explanation

1. PHI can only be accessed for the purpose of Treatment, Payment or Healthcare Operations (TPO). The medical student’s presentation in a classroom discussion does not meet the criteria of TPO.
2. PHI can only be accessed for the purpose of Treatment, Payment or Healthcare Operations (TPO), so it would be a serious HIPAA violation for an employee to share PHI with her husband.
3. Since patients’ names are PHI, that information cannot be displayed in a manner that would be visible to anyone who does not meet the TPO criteria.
4. Test results are PHI and cannot be displayed in a manner that anyone who does not meet the TPO criteria could see