Module #7: Healthcare

Question 1

Why privacy law in healthcare?

Answer 1

• protect one’s sense of self
• allows for more dialogue
• safeguards against unequal treatment

Question 2

How can covered entities ensure compliance with regulations that protect the privacy and security of healthcare info?

Answer 2

Covered entities include:
- health plans (health insurance co, HMO, company health plan, medicare/medicaid),

• healthcare clearing houses (ie: billing service, HRIS)
• healthcare providers who electronically transmit any health insurance.

Question 3

What does HIPPA stand for?

Answer 3

Health Insurance Portability and Accountability Act of 1996

Question 4

Why was HIPPA enacted?

Answer 4

• efficiency
• security (Payment)
• enforcement (dept of health and human services)

Question 5

What is PHI?

Answer 5

Protected Health Information (PHI) is:

• individually identifiable health information
• related to a physical or mental condition
• held by an entity

Question 6

What is ePHI?

Answer 6

Electronic Protected Health Information (ePHI)

-PHI that is transmitted or maintained in electronic media

Question 7

What covered entities are included by ePHI?

Answer 7

• Covered entities include:
  - -healthcare providers

  - -clearinghouses
  - -business associates such as claims processing and data analysis

Question 8

HIPPA Privacy and Security Rules 1

Answer 8

• Compliance of specific requirements
• Privacy and security of health information
• Written agreement or another arrangement

Question 9

HIPPA Privacy and Security Rules 2:

What are the 6 covered entities

Answer 9

1 privacy notice: 1st date

Covered entities:

Question 10

HIPPA Privacy and Security Rules 2:

Rules defined?

Answer 10

• ensure the confidentiality, integrity, and availability of all ePHI
• Protect anticipated threats, hazards, uses or disclosures
• ensure compliance

Question 11

What happened in Feinstein’s Institute for Medical research HIPPA settlement?

Answer 11

• ePHI was stolen off a laptop taken from an employees car.
• Office of Civil Rights (OCR) found that their security management was not compliant
• it failed to implement mechanisms for safeguarding ePHI
• paid $3.9 million to settle claims

Question 12

What is GINA?

Year?

Definition?

Answer 12

The Genetic Information Nondiscrimination Act

• enacted in 2008
• genetic testing

-protects individuals against genetic discrimination by insurance providers and employers

Question 13

What does GINA do for employers?

Answer 13

• Family members who have manifested a disease

- requirements or request for genetic information

Question 14

What does GINA do for insurance?

Answer 14

• implementing higher premiums based on genetic tests

- using genetic predisposition to deny coverage based on a preexisting condition

Question 15

What is HITECH

year?

defined?

offerings?

Answer 15

Health information Technology for Economic and Clinical Health

• 2009
• adoption and meaningful use of health information technology
• incentives for healthcare providers to use and develop electronic health records and a national electronic health information exchange

Question 16

How did HITECH strengthen existing HIPPA laws?

Answer 16

• data minimization
• increased penalties
• notice of breach
• electronic health records (ERHs)

Question 17

HITECH: data minimization

Answer 17

Refers to PHI including identifiers of the individual. Any data disclosed must be the minimum amount necessary.

Question 18

HITECH: increased penalties

Answer 18

Penalties up to $1.5 million are allowable and may extend to criminal liability even if the covered entity didn’t know about the violations

Question 19

HITECH: Notice of breach

Answer 19

entities or companies that handle PHI must notify individuals, the Dept of Health and Human Services, and potentially the media when security is compromised

Question 20

HITECH: electronic health records (EHRs)

Answer 20

–linked with local hospitals and used to share
necessary medical information for treatment, payment, or healthcare operations.

–promotes the goal of a National Health Information Network.

Question 21

Cures Act name?

Answer 21

The Cures Act and Confidentiality of Substance Use Disorder Patient Records Rule of 2016

Question 22

21st Century Cures Act definition?

Answer 22

–expedites the research process for new medical devices and prescription drugs

–quickens the process for drug approval

–reforms mental health treatment

Question 23

Cures act provisions?

Answer 23

• Prohibition of info-blocking: conduct that interferes with EHR
• “Certificates of confidentiality” for research requirements (particularly for alcoholics and substance abuse)
• “compassionate” sharing of mental health or substance abuse info with family or caregivers
• Exemptions for mandatory disclosure of individual biomedical research info under the Freedom of Information Act
• remote review of PHI under HIPAA rules

Question 24

Confidentiality of Substance Use Disorder Patient Records Rule

Answer 24

• 1970

- privacy protections for individuals seeking medical care for alcohol and substance abuse

Question 25

Confidentiality of Substance Use Disorder Patient Records Rule components?

Answer 25

``` #1 scope #2 applicability #3 Disclosure #4 Re-disclosure #5 exceptions #6 security ```

Question 26

Confidentiality of Substance Use Disorder Patient Records Rule scope defined

Answer 26

-- Use and disclosure of patient-identifying info -- restricting the use of info leading to criminal charges

Question 27

Confidentiality of Substance Use Disorder Patient Records Rule applicability defined

Answer 27

Federally funded programs and entities that: -- Are required by state licensing -- Use controlled substances that require licensing by the DEA

Question 28

Confidentiality of Substance Use Disorder Patient Records Rule disclosure defined

Answer 28

Consent form detailing the disclosure of information

Question 29

Confidentiality of Substance Use Disorder Patient Records Rule re-disclosure defined

Answer 29

-- Prohibits the re-disclosing of info if it would identify the individual as receiving treatment

Question 30

Confidentiality of Substance Use Disorder Patient Records Rule exceptions defined

Answer 30

Exceptions to consent requirements: - - Emergencies - - Research - - Evaluations - - Crimes on-premises or against personnel - - Child abuse reporting - - Court Orders

Question 31

Confidentiality of Substance Use Disorder Patient Records Rule security defined

Answer 31

Formal policies and procedures in place to ensure the security of information

Question 32

COVID-19 Consumer Data Protection Act of 2020

Answer 32

--protections for personal information as well as a preemption clause. --The bill was submitted on May 7, 2020, and referred to the Committee on Commerce, Science, and Transportation.

Question 33

COVID Bi-Partisan bill

Answer 33

regulate contact tracing apps to protect the privacy of those who do not want to be tracked as well as prohibit commercial use of any data collected.

Question 34

True or false? HIPAA preempts stricter state laws. True False

Answer 34

False

Question 35

Which is NOT a requirement under HIPAA’s Privacy Rule? A)_ A detailed privacy notice provided at the date of first service delivered B)_ Opt-out authorization for use or disclosure of personal health information outside of HIPAA guidelines C)_ Limited use and disclosure of personal health information for business associates, such as billing companies D)_Safeguards in place to protect the confidentiality and integrity of all personal health information

Answer 35

B)_ Opt-out authorization for use or disclosure of personal health information outside of HIPAA guidelines

Question 36

Who is responsible for enforcing HIPAA’s Privacy and Security Rules? A)_Office for Civil Rights (OCR) B)_Office of Compliance (OOC) C)_Agency for Healthcare Research and Quality (AHRQ) D)_Health Resources and Services Administration (HRSA)

Answer 36

A) OCR

Question 37

Which act is intended to expedite the research process for medical devices and prescription drugs? A)_Health Insurance Portability and Accountability Act (HIPAA) B)_Health Information Technology for Economic and Clinical Health Act (HITECH) C)_21st Century Cures Act D)_Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act

Answer 37

C) 21st Century Cures Act

Question 38

Which act introduced the first medical privacy provisions? A)_Health Insurance Portability and Accountability Act (HIPAA) B)_Health Information Technology for Economic and Clinical Health Act (HITECH) C)_21st Century Cures Act D)_Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act

Answer 38

D)_Comprehensive Alcohol Abuse and Alcoholism Prevention, Treatment and Rehabilitation Act

Question 39

True or false? Health insurance providers may, under some circumstances, implement higher premiums based on genetic information.

Answer 39

False