Medical Law and Ethics practice questions

Answer: B) Notifying affected patients after a breach of their unsecured health information

HITECH (2009) added breach notification requirements to HIPAA. Covered entities must notify affected people of breaches of unsecured health information within 60 days of discovery.

• AIncorrect. The Privacy Rule was issued under HIPAA years before HITECH was passed in 2009. HITECH changed and strengthened existing HIPAA rules; it did not create the Privacy Rule.
• BCorrect. HITECH led to the Breach Notification Rule (45 CFR 164.400-414). It requires covered entities to notify each affected person without unreasonable delay and no later than 60 calendar days after a breach is discovered.
• CIncorrect. Bloodborne pathogen protection comes from OSHA's Bloodborne Pathogens Standard, not from HITECH or HIPAA.
• DIncorrect. HIPAA allows health information to be shared for treatment without a signed authorization, and HITECH did not change that.

Answer: A) The practice may send the information for treatment without first getting the patient's written authorization

HIPAA lets covered entities share PHI with other providers for treatment without the patient's authorization. These treatment disclosures are also exempt from the minimum necessary standard.

• ACorrect. 45 CFR 164.506(a) and (c)(2) allow a covered entity to disclose PHI for another health care provider's treatment activities without the patient's authorization.
• BIncorrect. Disclosures for treatment, payment, and health care operations don't need an authorization. Under 164.506(b), getting the patient's consent for these disclosures is optional.
• CIncorrect. Section 164.506(c)(2) allows disclosure for the treatment activities of any health care provider, not only providers in the same organization.
• DIncorrect. Under 164.502(b)(2)(i), disclosures to a health care provider for treatment are exempt from the minimum necessary standard.

Answer: A) A minor surgical procedure

• ACorrect. Invasive procedures need documented consent.
• BIncorrect. Implied consent usually covers routine tasks.
• CIncorrect. Implied consent usually covers this.
• DIncorrect. That isn't treatment.

Answer: D) Ends care without proper notice or arrangements for continued care

• AIncorrect. Coverage was arranged.
• BIncorrect. That's appropriate care.
• CIncorrect. That's proper withdrawal.
• DCorrect. Patients must be given time to find another provider.

Answer: D) Report it to the privacy officer

• AIncorrect. A possible privacy breach must be reported.
• BIncorrect. Destroying records hides the problem.
• CIncorrect. The misdirected fax still needs to be addressed.
• DCorrect. Possible HIPAA breaches are reported so the office can respond as required.

Answer: B) Receive labels, safety data sheets, and training about hazardous chemicals at work

The Hazard Communication Standard gives workers the right to know and understand chemical hazards through labels, safety data sheets, and employer training. It doesn't create rights to refuse work, get medical exams, or have chemicals removed.

• AIncorrect. The standard is about communicating hazards through labels, safety data sheets, and training. It doesn't give workers a right to refuse to handle a chemical until a substitute is provided.
• BCorrect. OSHA states that employers must have labels and safety data sheets for exposed workers and must train them to handle the chemicals appropriately. This is the worker's right to know and understand.
• CIncorrect. Medical surveillance requirements come from other OSHA standards, such as the ones for specific substances. The Hazard Communication Standard covers information, labeling, and training.
• DIncorrect. The standard doesn't require employers to remove hazardous chemicals. It requires them to tell employees about the hazards and train them to handle the chemicals safely.

Answer: D) Explain that the provider will discuss it

• AIncorrect. Explain who will follow up.
• BIncorrect. That's outside an MA's scope.
• CIncorrect. The MA can't interpret results.
• DCorrect. Interpreting results is outside an MA's scope.

Answer: C) The employer

• AIncorrect. The doctrine applies to employers.
• BIncorrect. The patient is not liable for staff errors.
• CCorrect. Respondeat superior holds employers responsible for employees' acts within the scope of employment.
• DIncorrect. The employer may be held liable.

Answer: B) Slander

• AIncorrect. That's written.
• BCorrect. Written defamation is libel.
• CIncorrect. That's a threat of harm.
• DIncorrect. That's ending care improperly.

Answer: A) Pain medicine and other treatments continue, but CPR is withheld if breathing or heartbeat stops

A DNR order tells providers not to perform CPR if the patient's breathing or heartbeat stops. All other appropriate care continues, including medications, nutrition, pain control and diagnostic workups.

• ACorrect. A DNR order applies only to CPR. It does not give instructions about other treatments such as pain medicine, other medicines or nutrition.
• BIncorrect. A DNR order does not cover medicines or nutrition. Those continue as clinically appropriate.
• CIncorrect. A DNR order applies only to resuscitation. It does not limit tests, referrals or other appropriate care.
• DIncorrect. A valid DNR order tells providers not to perform CPR. A family member's request at the bedside does not override it.