Compliance with State and Federal Regulations, Including Confidentiality
This domain tests the rules that govern privacy, security, safety, and billing integrity - and your ability to spot a request you must not fulfill.
HIPAA
- Privacy Rule: treatment, payment, and operations (TPO) need no authorization; anything else does. Apply the minimum necessary standard.
- Patient rights: access to records within 30 days, amendment, accounting of disclosures, Notice of Privacy Practices, restriction requests, confidential communications.
- Security Rule: administrative, physical, and technical safeguards for electronic PHI.
- Breach notification: notify affected individuals within 60 days; HHS; media if more than 500 residents of a state are affected.
Other requirements
- OSHA Bloodborne Pathogens Standard: exposure control plan, hepatitis B vaccination offer, PPE, sharps handling, training.
- CLIA: waived versus moderate-complexity testing; certificate required.
- False Claims Act, Anti-Kickback Statute, Stark Law govern billing integrity and referrals.
- Retention: Medicare records six years (CMS); state law may require longer - follow the longer period.
- Minors and substance use disorder records are governed by state law and 42 CFR Part 2, which is stricter than HIPAA.
Worked example
A police officer presents a subpoena duces tecum for a patient's chart. Verify that the subpoena is valid and properly served and that the patient has been notified or a court order authorizes release; route it to the compliance officer; release only the records specified. A phone request from an attorney with no authorization gets refused.
Traps that cost marks
- Assuming HIPAA overrides stricter state law - it sets a floor, not a ceiling.
- Confirming a patient's presence or diagnosis to a caller.
- Discarding records in the regular trash instead of shredding or certified destruction.
- Releasing records on a verbal request.