CMAA - MOD 3 MEDICAL LAW, ETHICS,
AND COMPLIANCE QUESTIONS AND
ANSWERS WITH SOLUTIONS 2024
Health Insurance Portability and Accountability Act (HIPAA) - ANSWER Federal law that ensures
confidentiality of protected health information and sets the standards for health care code sets and
billing
The HIPAA Privacy Rule establishes national standards that define protected health information (PHI) and
how it should be accessed, used, and transmitted. HIPAA also allows individuals to access or request
corrections to their health information. Health plans, healthcare clearinghouses, medical organizations,
providers, and medical staff must comply with HIPAA regulations
Protected Health Information (PHI) - ANSWER Types:
Personally Identifiable Information (PII) - Any data associated with an individual
Individually identifiable health information (IIHI) - Health care data associated with an individual
PHI is IIHI that is used or transmitted by a covered entity. According to HIPAA, PHI includes one or more
of the following 17 identifiers:
1. Names (Full or last name and initial)
2. All geographical identifiers smaller than a state, except for the initial three digits of a zip code
3. Phone numbers
4. Fax numbers
5. Email addresses
6. Social Security numbers
7. Medical record numbers
8. Health insurance beneficiary numbers
9. Account numbers
10. Certificate/license numbers
11. Vehicle identifiers (including serial numbers and license plate numbers)
12. Device identifiers and serial numbers
13. Web uniform resource locators (URLs)
14. Internet protocol (IP) address numbers
, 15. Biometric identifiers, including finger, retinal, and voice prints
16. Full-face photographic images and any comparable images
17. Any other unique identifying number, characteristic, or code except the unique code assigned by the
investigator to code the data
The covered entity can disclose PHI with patient authorization or when the Privacy Rule specifically
allows it. Instances when there are permitted uses for disclosures of protected health information
include using it for treatment, payment, and health care operations (TPO). However, even with a suitable
reason for sharing health information, a covered entity must also meet the following three criteria:
1. Both covered entities must have or have had a relationship with the patient (can be a past or present
patient)
2. The PHI requested must pertain to the relationship
3. The discloser must disclose only the minimum information necessary for the healthcare operation at
hand
HIPAA regulation also includ
Informed Consent - ANSWER An oral or written agreement of mutual communication that ensures the
patient has been notified about their health care choices before making them
Abuse - ANSWER Any practice that may result in unnecessary costs to Medicare
Compliance - ANSWER Following mandated laws, policies, standards, and guidelines.\
Laws - ANSWER An obligation imposed by the authority to protect patients, providers, and property, and
non-compliance may lead to punishment
Regulations - ANSWER Rules or orders issued by an executive authority or regulatory agency of a
government with the force of law
Guidelines - ANSWER Written recommendations of policy
AND COMPLIANCE QUESTIONS AND
ANSWERS WITH SOLUTIONS 2024
Health Insurance Portability and Accountability Act (HIPAA) - ANSWER Federal law that ensures
confidentiality of protected health information and sets the standards for health care code sets and
billing
The HIPAA Privacy Rule establishes national standards that define protected health information (PHI) and
how it should be accessed, used, and transmitted. HIPAA also allows individuals to access or request
corrections to their health information. Health plans, healthcare clearinghouses, medical organizations,
providers, and medical staff must comply with HIPAA regulations
Protected Health Information (PHI) - ANSWER Types:
Personally Identifiable Information (PII) - Any data associated with an individual
Individually identifiable health information (IIHI) - Health care data associated with an individual
PHI is IIHI that is used or transmitted by a covered entity. According to HIPAA, PHI includes one or more
of the following 17 identifiers:
1. Names (Full or last name and initial)
2. All geographical identifiers smaller than a state, except for the initial three digits of a zip code
3. Phone numbers
4. Fax numbers
5. Email addresses
6. Social Security numbers
7. Medical record numbers
8. Health insurance beneficiary numbers
9. Account numbers
10. Certificate/license numbers
11. Vehicle identifiers (including serial numbers and license plate numbers)
12. Device identifiers and serial numbers
13. Web uniform resource locators (URLs)
14. Internet protocol (IP) address numbers
, 15. Biometric identifiers, including finger, retinal, and voice prints
16. Full-face photographic images and any comparable images
17. Any other unique identifying number, characteristic, or code except the unique code assigned by the
investigator to code the data
The covered entity can disclose PHI with patient authorization or when the Privacy Rule specifically
allows it. Instances when there are permitted uses for disclosures of protected health information
include using it for treatment, payment, and health care operations (TPO). However, even with a suitable
reason for sharing health information, a covered entity must also meet the following three criteria:
1. Both covered entities must have or have had a relationship with the patient (can be a past or present
patient)
2. The PHI requested must pertain to the relationship
3. The discloser must disclose only the minimum information necessary for the healthcare operation at
hand
HIPAA regulation also includ
Informed Consent - ANSWER An oral or written agreement of mutual communication that ensures the
patient has been notified about their health care choices before making them
Abuse - ANSWER Any practice that may result in unnecessary costs to Medicare
Compliance - ANSWER Following mandated laws, policies, standards, and guidelines.\
Laws - ANSWER An obligation imposed by the authority to protect patients, providers, and property, and
non-compliance may lead to punishment
Regulations - ANSWER Rules or orders issued by an executive authority or regulatory agency of a
government with the force of law
Guidelines - ANSWER Written recommendations of policy
