When responding to a client's request for information about the disclosure of his/her protected health information, which is NOT required?

Question

Options

• AThe purpose of the disclosure
• BA description of what information was sent
• CDisclosures for treatment, payment, or health care operations
• DThe dates of disclosure and to whom the information was sent

• A
  6% (3)
• B
  2% (1)
• C
  79% (38)
• D
  13% (6)

Explanation

Under HIPAA's Privacy Rule, patients have the right to request an accounting of disclosures - but this right comes with a significant carve-out: disclosures made for treatment, payment, or healthcare operations (TPO) are explicitly exempt from this requirement. Because TPO disclosures are so routine and frequent, including them would create an administrative burden without meaningful benefit to the patient, so Congress excluded them entirely.

Why the distractors are wrong:

• A (purpose) - Required. The covered entity must explain why the PHI was shared.
• B (description of information sent) - Required. The patient is entitled to know what was disclosed.
• D (dates and recipient) - Required. The accounting must include when and to whom PHI was sent.

Memory tip: Think of the exemption as the "TPO Free Pass" - Treatment, Payment, and Operations are the three pillars of normal healthcare business, so HIPAA gives them a pass from the accounting requirement. If you see any answer choice that mentions routine clinical or billing activity, it's likely the one that does not need to be disclosed in an accounting.

No community discussion yet for this question.