HIPAA Questions
docx
keyboard_arrow_up
School
University of Puerto Rico, Rio Piedras *
*We aren’t endorsed by this school
Course
101
Subject
Information Systems
Date
Feb 20, 2024
Type
docx
Pages
4
Uploaded by cecillegautier
What it stands for: -
The Health insurance Portability and Accountability Act
∙
What kind of information is protected?
-
All medical records and other individually identifiable health information used or disclosed
-
Electronic, paper, or orally enclosed information
∙
Who must follow certain procedures to protect this information?
-
Health plans, health care clearinghouses, and healthcare providers that conduct electronic transactions listed in the Administrative Requirements are required to comply with the Privacy Rule, in addition to business associates in certain circumstances, when their services pertain to the details of their “covered entity.”
∙
You recently had a breach of data privacy. ∙
What do you have to do now and how much time do you have to do it?
-
180- days
-
“Following a breach of unsecured protected health information, covered entities must provide notification of the breach to affected individuals, the Secretary, and, in certain circumstances, to the media. In addition, business associates must notify covered entities if a breach occurs at or by the business associate.”
-
Insufficient or out-of-date contact information for 10 or more individuals = the covered
entity must provide individual notice on the home page of its web site for at least 90 days or in major print or broadcast media. Toll-free phone number that remains active for at least 90 days where individuals can learn if their information was involved in the breach. -
Fewer than 10 individuals, the covered entity may provide substitute notice by an alternative form of written notice, by telephone, or other means. -
These individual notifications must be provided without unreasonable delay and in no
case later than 60 days following the discovery of a breach and must include, to the extent possible, a brief description of the breach, a description of the types of information that were involved in the breach, the steps affected individuals should take to protect themselves from potential harm, a brief description of what the covered entity is doing to investigate the breach, mitigate the harm, and prevent further breaches, as well as contact information for the covered entity (or business associate, as applicable).
-
Report within 180 days
∙
You are a health care provider. One of your physicians accessed the medical records of celebrities and other patients without authorization. Dr. XXX accessed the records of patients without authorization 323 times after learning that he would soon be dismissed. Yes, it is a violation of HIPAA and may cause troubles. The impermissible disclosure
of Protected Health Information may qualify as a data breach
∙A patient of Dr. XXX’s practice just complained that Dr. XXX disclosed his condition to the patient’s insurance company to get reimbursement for the procedure Dr. XXX did for the patient.
Yes, there would be a violation. HIPAA prohibits doctors from sharing personal health information from a patient's insurance unless they have granted them permission. In this
case the doctor disclosed the patient's condition to their insurance without their consent.
∙Dr. XXX disclosed the details surrounding the treatment of a patient for the purpose of studying a particular disease that afflicts the patient. Dr. XXX did not disclose any information that could identify the patient.
There would be no violation, as HIPAA allows doctors to disclose patient information among themselves if it is considered to be necessary to their health and treatment, and if they are involved with the patient’s healthcare. Furthermore, since there was no personal identifiable information, there remains no reason for objection by the patient.
∙A hospital employee left a telephone message with the daughter of a patient that detailed both her medical condition and treatment plan. ∙Is this ok because it’s the patient’s daughter?
No it is not ok. Any individually identifiable health information relating to an individual's past, present, or future physical or mental condition, treatment for the condition, or payment for the treatment is protected by the HIPAA Privacy Rule, along with individually identifiable non-health information maintained in the same “designated record set”.
∙
The Justice Department caught Dr. XXX using/selling protected health information.
∙
What’s next for Dr. XXX?
Offenses committed with the intent to sell, transfer or use individually identifiable health information for commercial advantage, personal gain or malicious harm permit fines of $250,000
and imprisonment up to 10 years. Medical license revoked
Your preview ends here
Eager to read complete document? Join bartleby learn and gain access to the full version
- Access to all documents
- Unlimited textbook solutions
- 24/7 expert homework help