Registered Health Information Administrator / Technician (RHIA / RHIT) Health Law, Privacy, Security, and Compliance Syllabus

Health Law, Privacy, Security, and Compliance syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Health Law, Privacy, Security, and Compliance in Registered Health Information Administrator / Technician (RHIA / RHIT), not a summary of it.

1. 1

   Legal Framework of Health Information

   3 topics

   • Sources of Health Law
     • Statutes, regulations, and case law
     • Federal versus state authority
   • The Legal Health Record
     • Defining the legal health record and designated record set
     • Record retention and destruction
     • Admissibility and e-discovery
   • Consent and Authorization
     • Informed consent principles
     • Valid authorization elements
     • Minors, incompetence, and surrogate decision-making
2. 2

   HIPAA Privacy Rule

   3 topics

   • Protected Health Information Fundamentals
     • Definition of PHI and de-identification
     • Covered entities and business associates
   • Uses and Disclosures
     • Treatment, payment, and operations
     • Minimum necessary standard
     • Accounting of disclosures
   • Patient Rights
     • Right of access and amendment
     • Notice of privacy practices
     • Restrictions and confidential communications
3. 3

   HIPAA Security Rule and Data Protection

   3 topics

   • Security Safeguards
     • Administrative, physical, and technical safeguards
     • Access controls and audit controls
     • Encryption and transmission security
   • Risk Analysis and Management
     • Conducting security risk assessments
     • Contingency planning and disaster recovery
   • Breach Notification
     • Breach definition and risk assessment
     • Notification timelines and HITECH provisions
4. 4

   Compliance Programs

   3 topics

   • Elements of an Effective Compliance Program
     • OIG seven elements
     • Codes of conduct and training
   • Fraud and Abuse Laws
     • Anti-Kickback Statute and Stark Law
     • RAC and other audit programs
   • Ethics in Health Information
     • AHIMA Code of Ethics
     • Confidentiality and professional conduct

Health Law, Privacy, Security, and Compliance flashcards for Registered Health Information Administrator / Technician (RHIA / RHIT)

18 of 50 cards from the Health Law, Privacy, Security, and Compliance deck — real questions with worked answers.

1. What are the four primary sources of health law in the United States?

   Constitutional law, statutory law (enacted by legislatures), administrative/regulatory law (issued by agencies), and common/case law (judicial decisions).

2. What is the difference between statutory law and regulatory (administrative) law?

   Statutory law is enacted by a legislature (e.g., Congress passing HIPAA); regulatory law consists of the rules and regulations issued by administrative agencies (e.g., HHS) to implement and enforce those statutes.

3. When federal and state health information laws conflict, which generally prevails under HIPAA preemption?

   HIPAA sets a federal floor; the more stringent (more protective of patient privacy or granting greater patient access) law prevails. State law that is more stringent is not preempted.

4. What is the difference between civil law and criminal law in the health care context?

   Civil law resolves disputes between private parties (e.g., negligence/malpractice) with remedies like monetary damages; criminal law involves offenses against the state (e.g., fraud) punishable by fines or imprisonment.

5. What are the four elements a plaintiff must prove in a medical negligence (malpractice) claim?

   Duty (a legal obligation of care), breach (failure to meet the standard of care), causation (the breach caused the injury), and damages (actual harm/injury).

6. What is the legal health record (LHR)?

   The documentation of patient care that an organization will disclose upon a legal request; it is the official business record generated at or for a healthcare organization, defined by the organization in policy.

7. How does the designated record set (DRS) differ from the legal health record?

   The legal health record is what is released for legal proceedings; the designated record set is broader, including all records used to make decisions about an individual (medical and billing records) and is the set patients have a right to access under HIPAA.

8. What is the purpose of a record retention schedule?

   It specifies how long different types of health records must be kept, based on legal, regulatory, accreditation, and operational requirements, and governs when records may be destroyed.

9. What is metadata in the context of an electronic legal health record, and why does it matter legally?

   Metadata is data about data (e.g., audit trails, timestamps, author, edits). It matters because it can be discoverable in litigation and helps establish authenticity and integrity of the record.

10. What is the difference between record amendment, correction, and deletion in a health record?

    A correction fixes an error before authentication; an amendment adds clarifying information after authentication (original remains visible); deletion (removing entries) is generally prohibited because record integrity must be preserved.

11. What is the difference between consent and authorization under HIPAA?

    Consent is general permission for treatment, payment, and operations (TPO) and is optional under HIPAA; authorization is a specific, written permission required to use or disclose PHI for purposes outside TPO.

12. List the core required elements of a valid HIPAA authorization.

    Description of information to be disclosed, who may disclose it, who may receive it, purpose of the disclosure, an expiration date or event, the individual's signature and date, and statements of the right to revoke and that conditioning may not occur.

13. What are the requirements for valid informed consent for treatment?

    The patient must be competent, given adequate information (diagnosis, nature of procedure, risks, benefits, alternatives, consequences of refusal), and must voluntarily agree without coercion.

14. Who may provide consent for a minor's treatment, and name a common exception.

    A parent or legal guardian generally consents; exceptions (where minors may consent for themselves) include emancipated minors and care for reproductive health, STIs, mental health, or substance abuse (varies by state).

15. What is the difference between express consent and implied consent?

    Express consent is explicitly given orally or in writing; implied consent is inferred from a patient's actions or circumstances (e.g., emergency care to preserve life when the patient cannot consent).

16. What does PHI (Protected Health Information) mean under HIPAA?

    Individually identifiable health information transmitted or maintained in any form (electronic, paper, oral) that relates to a person's health condition, care, or payment, held by a covered entity or business associate.

17. What is the difference between PHI and ePHI?

    PHI is protected health information in any form (oral, paper, electronic); ePHI is PHI that is created, received, maintained, or transmitted in electronic form and is the focus of the HIPAA Security Rule.

18. How many HIPAA identifiers must be removed to de-identify PHI under the Safe Harbor method?

    18 identifiers (e.g., name, address, dates, SSN, medical record number, etc.) must be removed, and the entity must have no actual knowledge the information could re-identify the individual.

See more Health Law, Privacy, Security, and Compliance flashcards →

Planning Health Law, Privacy, Security, and Compliance for Registered Health Information Administrator / Technician (RHIA / RHIT)

Health Law, Privacy, Security, and Compliance (Registered Health Information Administrator / Technician (RHIA / RHIT)) FAQ