Individual privacy rights as defined in the HIPAAPrivacy Rule include
consent and authorization by the patient for the release of PHI. The
difference between consent and authorization as used in the Privacy Rule is:
A.
Consent grants general permission to use or disclose PHI, and
authorization limits permission to the purposes and the parties
specified in the authorization.
B.
Consent grants general permission to use or disclose PHI, and
authorization limits permission to the purposes specified in the
authorization.
C.
Authorization grants general permission to use or disclose PHI, and
consent limits permission to the purposes and the parties specified
in the consent.
D.
Consent grants general permission to use or disclose PHI, and
authorization limits permission to the parties specified in the
authorization.
Explanation:
Answer b is therefore incorrect. Answer c is incorrect since the
limits to authorization do not include the parties concerneD . Answer
d is incorrect since the limits to authorization do not include the
specified purposes. The other individual privacy rights listed in the
HIPAA Privacy Rule are:
Notice (of the covered entities privacy practices)
Right to request restriction
Right of access
Right to amend
Right to an accounting
In August of 2002, the U.S. Department of Health and Human
Services (HHS) modified the Privacy Rule to ease the requirements
of consent and allow the covered entities to use noticE . The changes
are summarized as follows:
Covered entities must provide patients with notice of the patients
privacy rights and the privacy practices of the covered entity.
Direct treatment providers must make a good faith effort to
obtain patients written acknowledgement of the notice of
privacy rights and practices. (The Rule does not prescribe a form
of written acknowledgement; the patient may sign a separate
sheet or initial a cover sheet of the notice.)
Mandatory consent requirements are removed that would inhibit
patient access to health care while providing covered entities
with the option of developing a consent process that works for
that entity. If the provider cannot obtain a written
acknowledgement, it must document its good faith efforts to
obtain one and the reason for its inability to obtain the
acknowledgement.
Consent requirements already in place may continue.