CITI Training Questions and Answers Rated A

A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT: Data that does not cross state lines when disclosed by the covered entity. Under HIPAA, a "disclosure accounting" is required: For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets. When required, the information provided to the data subject in a HIPAA disclosure accounting ... must be more detailed for disclosures that involve fewer than 50 subject records. If you're unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with: An organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security official ("Security Officer"), depending on the issue. Under HIPAA, "retrospective research" (a.k.a., data mining) on collections of PHI generally ... Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization.