HIPAA Practice Questions

Q: On a Sunday afternoon, a surgical oncologist and his family attend a football game in the city where he practices. While at the game, he runs into a physician colleague that works at the same institution. After some casual small talk, his colleague inquires, "Are you taking care of Mr. Clarke, my personal trainer? I heard through the grapevine that he has melanoma, and I didn't know if you have started him on any chemotherapy or performed any surgical intervention yet. Hopefully you'll be able to take very good care of him." In this situation, the surgical oncologist may confirm which of the following?

No information at all. *Incorrect: The patient's name* - Confirming the patient's name would still be a breach of **confidentiality** under **HIPAA**, as it acknowledges the individual is a patient with the inquiring physician. - Even if the name is already known to the colleague, confirming it from the treating physician implies an **established patient relationship**, which is PHI. *Incorrect: The patient's diagnosis* - Disclosing the patient's diagnosis is a direct violation of **HIPAA** rules, as it releases specific **protected health information** without the patient's explicit consent. - This information is highly sensitive and directly related to the individual's health status, which must be kept confidential. *Incorrect: The patient's treatment plan* - Sharing details about the **treatment plan** is a clear breach of **patient privacy** and **HIPAA regulations**. - This information is considered **protected health information (PHI)** and can only be shared with those directly involved in the patient's care or with patient consent. *Incorrect: Only that Mr. Clarke is his patient* - Even confirming that Mr. Clarke is a patient constitutes a breach of **confidentiality** and **HIPAA**. - Acknowledging a patient-physician relationship is considered releasing **protected health information** because it implicitly confirms health services are being rendered to that individual. ***Correct: No information at all*** - Disclosure of any protected health information (PHI) to unauthorized individuals, even other healthcare professionals, is a violation of **HIPAA**. - The colleague did not establish a **physician-patient relationship** with Mr. Clarke, nor did they have a legitimate need to know this information for treatment, payment, or healthcare operations. - Without patient authorization or a legitimate purpose under the **Privacy Rule**, the surgical oncologist must not confirm any PHI, including the mere existence of a patient-physician relationship.

Q: A 42-year-old woman presents to the physician with symptoms of vague abdominal pain and bloating for several months. Test results indicate that she has ovarian cancer. Her physician attempts to reach her by phone multiple times but cannot reach her. Next of kin numbers are in her chart. According to HIPAA regulations, who should be the primary person the doctor discusses this information with?

The patient. ***The patient*** - Under **HIPAA**, the patient has the **right to privacy** regarding their protected health information (PHI). Therefore, the physician must make all reasonable attempts to contact the patient directly to convey their diagnosis. - Sharing sensitive medical information like a cancer diagnosis with anyone other than the patient, without their explicit consent, would be a **violation of HIPAA regulations**. *The patient's brother* - The patient's brother is not automatically authorized to receive her medical information, even if listed as **next of kin**, without the patient's explicit consent or a documented **healthcare power of attorney**. - Discussing the diagnosis with the brother without the patient's direct consent would be a **breach of patient confidentiality**. *The patient's husband* - Even a spouse does not automatically have the right to access a patient's **PHI** without the patient's express permission, according to **HIPAA**. - While often a trusted contact, without explicit consent, revealing the diagnosis to the husband would still violate the patient's **privacy rights**. *The patient's daughter* - Similar to other family members, the patient's daughter is not legally entitled to receive her mother's confidential medical information without explicit authorization or a medical **power of attorney**. - The physician's primary responsibility is to the patient herself, ensuring her **privacy** is maintained. *All of the options* - According to **HIPAA**, sharing the patient's diagnosis with any family member without her explicit consent would be a **breach of confidentiality**. - This option incorrectly assumes that **next of kin** automatically have the right to receive sensitive medical information.

Question 1

On a Sunday afternoon, a surgical oncologist and his family attend a football game in the city where he practices. While at the game, he runs into a physician colleague that works at the same institution. After some casual small talk, his colleague inquires, "Are you taking care of Mr. Clarke, my personal trainer? I heard through the grapevine that he has melanoma, and I didn't know if you have started him on any chemotherapy or performed any surgical intervention yet. Hopefully you'll be able to take very good care of him." In this situation, the surgical oncologist may confirm which of the following?

Accepted Answer

No information at all

Answer

The patient's name

Answer

The patient's diagnosis

Answer

The patient's treatment plan

Answer

Only that Mr. Clarke is his patient

Question 2

A 17-year-old male, accompanied by his uncle, presents to a doctor with his arm in a sling. There is blood dripping down his shirt. He pleads with the physician to not report this injury to authorities, offering to pay extra for his visit, as he is afraid of retaliation from his rival gang. The physician examines the wound, which appears to be a stabbing injury to his left anterior deltoid. This case study in medical ethics asks: How should the physician best handle this patient's request?

Accepted Answer

Breach confidentiality and report the stab wound to the police

Answer

Maintain confidentiality, as reporting stab wounds is not required

Answer

Breach confidentiality and discuss the injury with the uncle

Answer

Maintain confidentiality and schedule a follow-up visit with the patient

Answer

Maintain confidentiality, as retaliation may result in greater harm to the patient

Question 3

A 42-year-old woman presents to the physician with symptoms of vague abdominal pain and bloating for several months. Test results indicate that she has ovarian cancer. Her physician attempts to reach her by phone multiple times but cannot reach her. Next of kin numbers are in her chart. According to HIPAA regulations, who should be the primary person the doctor discusses this information with?

Accepted Answer

The patient

Answer

The patient's brother

Answer

The patient's husband

Answer

The patient's daughter

Answer

All of the options

Question 4

A 62-year-old man comes to his primary care physician with a 3-month history of insomnia and severe work anxiety. He says that he is unable to retire because he has no financial resources; however, the stress level at his work has been causing him to have worsening performance and he is afraid of being fired. He thinks that he would be able to resume work normally if he was able to decrease his level of anxiety. His physician prescribes him a trial 1-month regimen of benzodiazepine therapy and schedules a follow-up appointment to see whether this treatment has been effective. Three weeks later, the patient's wife calls and says "My husband was fired from work and it's your fault for prescribing that medication! I know he must have been taking too much of that drug. Don't you know that he had a horrible problem with drug abuse in his 30s?" Which of the following is the most appropriate first action for the physician to take?

Accepted Answer

Contact the patient directly to discuss the situation

Answer

Discharge the patient for inappropriate use of medication

Answer

Contact the physician's medical practice insurance company regarding a potential claim

Answer

Refer the patient to a substance abuse program

Answer

Inform the patient's wife that patient information cannot be disclosed to her due to HIPAA

Question 5

A 32-year-old man visits a clinic for routine health check-up. He discloses having an extramarital relationship several months ago and requests screening for sexually transmitted infections. One week later, his fourth-generation HIV antibody and antigen test returns positive. After appropriate counseling about the diagnosis, the patient explicitly requests that his HIV status not be disclosed to anyone, including his wife. The patient's wife is also registered as a patient at the same clinic. According to US medical ethics and patient confidentiality laws, what is the most appropriate next step for the physician?

Accepted Answer

Offer the patient repeat antibody testing to confirm results

Answer

Inform the wife immediately of the positive result

Answer

Schedule a group meeting with the patient and wife to disclose the results

Answer

Wait for one week before you disclose the results to his wife

Answer

Report the infection to the national health authorities

HIPAA — MCQs

HIPAA — MCQs

On this page

Practice by Chapter

Want unlimited practice?