New Patient Rights Scenarios

HIPAA gave consumers the right to request that covered entities restrict certain disclosures of their protected health information, but it did not require covered entities to comply. ARRA does—in certain situations. ARRA also expands patients’ rights to an accounting of disclosures.

How well do you know the new provisions? Test your knowledge with the following scenarios. Select the one best answer; each correct answer is based directly on a given section of the law.

You also may download the scenarios as a PDF, which includes aggregated results of more than 900 AHIMA members who took the quiz previously.

Scenario 1

Request for Restriction

The ABC Center receives a request for restrictions from Mr. Smith to withhold information. He has paid for his encounter in full at the time of service and requests that his records not be released to anyone for any reason.

Shortly thereafter Mr. Smith is involved in a car accident, and his wife indicates to the emergency department at Anywhere Medical that his primary medical provider is ABC Center. The ED at Anywhere Medical requests pertinent records to treat Mr. Smith. What information may ABC Center release by law?

  1. All records pertinent to care, except the restricted records
  2. No records, because there is a restriction on file
  3. All records, to ensure patient care
  4. All records pertinent to care, including the restricted records

Answer:
[spoiler]
4. Mr. Smith has paid for the encounter in full at the time of service, which does entitle him to a restriction under the ARRA modifications. However, the restriction applies only to disclosures to health plans. ABC Medical may release the records to Anywhere Medical if they are pertinent to Mr. Smith’s care.

Excerpt from § 13405(a): “…the covered entity must comply with the requested restriction if (1) except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment)…”
[/spoiler]
.

Scenario 2

Request for Restriction

After his accident, Mr. Smith returns to the ABC Center for a test. He pays his copayment at the time of service and requests that no record of the test or its results be released. Under the ARRA modifications, ABC Medical Center:

  1. Must honor the request, because all patient requests for restrictions must now be fulfilled
  2. Must honor the request only if it is certain it can do so
  3. Is not required to honor the request, because Mr. Smith did not pay for the test in full
  4. Is not required to honor the request, because the request is unreasonable

Answer:
[spoiler]
3. ABC Medical is not required to honor the request, because Mr. Smith did not pay for the test in full. The right to restrictions applies only to items or services that the patient pays in full.

Excerpt from § 13405(a): “…the covered entity must comply with the requested restriction if… (2) the protected health information pertains solely to a health care item or service for which the health care provider involved has been paid out of pocket in full.”
[/spoiler]
.

Scenario 3

Accounting of Disclosure

Mr. Smith writes ABC Center and requests an accounting of disclosures of his protected health information. ABC Center meets the criteria of the ARRA modifications and must comply with them. In fulfilling Mr. Smith’s request, ABC Center must account for:

  1. Only those disclosures for which Mr. Smith has not signed an authorization
  2. All disclosures for treatment, payment, and operations
  3. Only those disclosures for payment purposes that do not have an authorization
  4. Only disclosures for operations purposes that do not have an authorization

Answer:
[spoiler]
2. ABC Center must account for all disclosures, including those for treatment, payment, and operations. ARRA rescinds the TPO exception granted under HIPAA for covered entities that use or maintain an EHR system.

Excerpt from § 13405(c)(1): “In applying section 164.528 of title 45, Code of Federal Regulations, in the case that a covered entity uses or maintains an electronic health record with respect to protected health information—(A) the exception under paragraph (a)(1)(i) of such section shall not apply to disclosures through an electronic health record made by such entity of such information…”
[/spoiler]
.

Scenario 4

Accounting of Disclosure

On January 1, 2011, Mr. Smith phones ABC Center to request an accounting of disclosures. ABC uses an EHR system that it purchased in mid-2008. Mr. Smith last requested an accounting five months earlier. Is ABC Center required to abide by the terms of the ARRA modifications?

  1. No, fewer than 6 months have elapsed since Mr. Smith’s last request
  2. No, ABC Center does not need to comply with the ARRA provisions until January 1, 2014
  3. Yes, ABC Center uses an EHR
  4. Yes, ABC Center is required to comply with the ARRA provisions as of January 1, 2011

Answer:
[spoiler]
2. Covered entities that purchased EHR systems prior to January 1, 2009, have until January 1, 2014, to comply with the ARRA accounting of disclosures provisions. Covered entities that purchased systems after January 1, 2009, must comply on January 1, 2011.

Excerpt from § 13405(c)(4): “(A) Current Users of Electronic Records—In the case of a covered entity insofar as it acquired an electronic health record as of January 1, 2009, paragraph (1) shall apply to disclosures…made by the covered entity from such a record on and after January 1, 2014.”
[/spoiler]
.

Scenario 4 Bonus Question

Mr. Smith has been a patient of ABC Center for 23 years. Under the ARRA modifications, how many years of disclosures must ABC Center provide him?

  1. 2.5 years—the length of time the current EHR system has been in use
  2. 3 years
  3. 7 years
  4. 23 years

Answer:
[spoiler]
2. For covered entities using EHR systems, ARRA reduces the length of the accounting period to three years.

Excerpt from § 13405(c)(1): ‘‘(B) an individual shall have a right to receive an accounting of disclosures … during only the three years prior to the date on which the accounting is requested.”
[/spoiler]
.

Use for an organization’s internal educational purposes permissible without request as long as proper citation is made. Commercial use is not permitted. A version of scenario 1 was originally published in the June 2010 print edition.

9 Comments

  1. Currently, if a disclosure is pursuant to an authorization, it is not required to be listed in the accounting. Under HITECH, would a disclosure for treatment from an electronic record that is pursuant to an authorization be accountable? Would the authorization exception apply?

    Post a Reply
  2. Thank you so much for developing these scenarios for membership to sharping our skills.

    Post a Reply
  3. These scenarios were very helpful. I hope you do this with other hot topics.

    Post a Reply
  4. These scenarios are helpful in understanding the new requirements. Hope to see more.

    Post a Reply
  5. These are very helpful. Thank you. Would love to see more on this and other current topics.

    Post a Reply
  6. Although I am a student, these scenarios are extremely helpful and useful, if not now, for future reference. Thank you

    Post a Reply
  7. As a busy manager, it is always nice to have these scenarios. Would like to see more on other new laws.

    Post a Reply
  8. As a new member these scenarios are enlightening and very helful towards my quest for knowledge. Thank you.

    Post a Reply

Submit a Comment

Your email address will not be published. Required fields are marked *