Healthcare Privacy, Ethics, and Regulatory Compliance
The Healthcare Privacy, Ethics, and Regulatory Compliance domain tests HIPAA and related rules, patient rights, ethical transcription conduct, and release-of-information decisions. Items often present a scenario and ask whether a disclosure is permitted.
Core rules
- PHI is individually identifiable health information transmitted or maintained in any form. The 18 HIPAA identifiers include name, dates tied to an individual (except year), geographic data smaller than a state, phone/fax, email, SSN, medical record number, health plan number, account number, certificate/license number, vehicle identifiers, device identifiers, URLs, IP addresses, biometric identifiers, full-face photos, and any other unique identifying number or code.
- Permitted uses and disclosures without authorization include treatment, payment, and health care operations (TPO), plus certain public health, law enforcement, and research exceptions. Other disclosures require a valid authorization with core elements: description of information, purpose, expiration, right to revoke, and signature.
- Minimum necessary applies to uses and disclosures except treatment, disclosures to the individual, and certain required disclosures.
- Patient rights include access, amendment, accounting of disclosures, request for restrictions, and confidential communications.
- Security requires administrative, physical, and technical safeguards. A breach is an impermissible use or disclosure; notification generally occurs within 60 days, and state law may be stricter.
- Ethics require accuracy, confidentiality, avoiding alteration of records, and staying within scope.
Worked example
An attorney faxes a request for a patient’s entire chart without an authorization. The correct response is to decline the disclosure as requested and route the request through the release-of-information process. Reasoning: an attorney is not a treating provider, so TPO does not apply; a valid authorization or legal process is required. Even with authorization, release only the information described, apply minimum necessary, verify the recipient, and log the disclosure for the accounting. If the fax was misdirected and PHI was received by an unauthorized person, assess whether a breach occurred and follow notification policy.
Traps
Do not assume that a hospital employee may access any record “for work.” Do not confuse use (internal sharing) with disclosure (external release). Do not apply federal rules while ignoring stricter state law on HIV, mental health, substance use, or minors. Do not release an entire record when only a date range or specific item was requested. Never discuss PHI on social media or in an unsecured message.