Confidentiality and Privacy Practice Questions

37 multiple-choice questions on Confidentiality and privacy for paramedic and EMT students, from Chapter 4 (Medical, Legal, and Ethical Issues). Read each question, pick your answer, then tap Show answer to check it and read the explanation.

37 practice questions

1. Protected health information includes:

   1. A. Only written or printed patient records
   2. B. Only diagnoses recorded in the medical chart
   3. C. Any identifiable health information
   4. D. Only records kept by a hospital
   Show answer

   Answer: C. Any identifiable health information

   It includes name, address, and details of care. Identifiers combined with health details are what make it protected.

2. Under HIPAA, patient information may be shared without specific authorization for:

   1. A. Updating any family member who asks
   2. B. Treatment, payment, and operations
   3. C. Responding to inquiries from news media
   4. D. Any purpose the agency considers reasonable
   Show answer

   Answer: B. Treatment, payment, and operations

   Sharing with the receiving hospital is treatment.

3. The minimum necessary standard means:

   1. A. Share as little as possible with the receiving nurse
   2. B. Document as little detail as possible
   3. C. Disclose only what the purpose requires
   4. D. Never share information without written consent
   Show answer

   Answer: C. Disclose only what the purpose requires

   Disclose only the information needed for the purpose at hand. It does not restrict information needed for patient treatment.

4. Discussing a call in a hospital hallway where others can hear is:

   1. A. Acceptable among health care professionals
   2. B. Required as part of a proper hand-off
   3. C. Permitted if the patient's name is not used
   4. D. A privacy violation to avoid
   Show answer

   Answer: D. A privacy violation to avoid

   Move the conversation to an appropriate area.

5. Posting photos or details of a call on social media is:

   1. A. A serious breach of confidentiality
   2. B. Encouraged when shared for education
   3. C. Permitted if posted after the call closes
   4. D. Allowed if the patient's name is not used
   Show answer

   Answer: A. A serious breach of confidentiality

   It can end a career and trigger penalties. Location and timing alone can identify a patient.

6. A paramedic may release patient information to law enforcement:

   1. A. When permitted or required by law
   2. B. Any time an officer on scene requests it
   3. C. Never, under any circumstances
   4. D. Only when the patient is present to hear it
   Show answer

   Answer: A. When permitted or required by law

   Examples include mandatory reports, warrants, and specific state provisions. Know your state rules and your agency's policy.

7. A patient generally has the right to:

   1. A. Access their record and request corrections
   2. B. Rewrite portions of the care report
   3. C. Prohibit the hospital from seeing it
   4. D. Have the record permanently deleted
   Show answer

   Answer: A. Access their record and request corrections

   Requests are handled through the agency's records process.

8. Penalties for HIPAA violations may include:

   1. A. Fines, job loss, and criminal charges
   2. B. Nothing, since EMS is exempt from HIPAA
   3. C. Retraining only, with no financial penalty
   4. D. Civil fines with no criminal exposure
   Show answer

   Answer: A. Fines, job loss, and criminal charges

   Penalties include civil monetary penalties, employment action, and in some cases criminal charges. Intentional snooping is treated especially seriously. Knowing or malicious disclosures can bring criminal charges.

9. Which is an acceptable use of patient information?

   1. A. A case shared with a friend who is a nurse
   2. B. A post that omits the patient's name
   3. C. A scene photo sent to the crew's group chat
   4. D. De-identified cases for agency education
   Show answer

   Answer: D. De-identified cases for agency education

   De-identified cases may be used for education and quality improvement. De-identification means removing information that could reveal who it was. A friend who is a nurse is not on the care team, details can identify a patient without a name, and a group chat is not a secure clinical channel.

10. Giving a patient's information to a news reporter at the scene is:

    1. A. Not permitted; refer to the spokesperson
    2. B. Allowed if the name is withheld
    3. C. Allowed if the patient is a public figure
    4. D. Appropriate if the reporter saw it
    Show answer

    Answer: A. Not permitted; refer to the spokesperson

    Public information officers handle these requests. Public figures have the same privacy protections.

11. Family members asking about a patient's condition should generally be:

    1. A. Told what is appropriate, per policy
    2. B. Refused any information whatsoever
    3. C. Told all the patient disclosed
    4. D. Given full assessment details
    Show answer

    Answer: A. Told what is appropriate, per policy

    Share what is appropriate to the situation and defer to hospital staff and policy. A conscious patient can indicate what they want shared.

12. Records requests, subpoenas, and legal demands for a patient care report should be:

    1. A. Handled personally by the medical director
    2. B. Answered by the agency's billing office
    3. C. Routed to the records custodian
    4. D. Answered directly by the crew involved
    Show answer

    Answer: C. Routed to the records custodian

    Requests go to the agency's records custodian and legal counsel. Never alter a record in response to a request. Billing staff do not handle legal requests.

13. HIPAA stands for:

    1. A. Hospital Insurance Portability and Access Act
    2. B. Health Insurance Portability and Accountability Act
    3. C. Health Information Protection and Access Act
    4. D. Health Information Portability and Accountability Act
    Show answer

    Answer: B. Health Insurance Portability and Accountability Act

    It was enacted in 1996.

14. Covered entities under HIPAA include:

    1. A. Hospitals only, not prehospital agencies
    2. B. Licensed physicians and nurses only
    3. C. Insurers only, since they handle billing
    4. D. Providers, plans, and clearinghouses
    Show answer

    Answer: D. Providers, plans, and clearinghouses

    Covered providers are those that transmit health information electronically. Most EMS agencies qualify.

15. The HIPAA Privacy Rule governs:

    1. A. Only electronic protected health information
    2. B. Only paper records kept by covered entities
    3. C. Uses and disclosures of PHI in any form
    4. D. Only billing and insurance transactions
    Show answer

    Answer: C. Uses and disclosures of PHI in any form

    Verbal disclosures count.

16. The HIPAA Security Rule addresses:

    1. A. Billing codes and claims submission
    2. B. Verbal disclosures of patient information
    3. C. Storage and destruction of paper records
    4. D. Safeguards for electronic records
    Show answer

    Answer: D. Safeguards for electronic records

    Encryption and access controls are examples.

17. Protected health information remains protected:

    1. A. Only while care is being provided
    2. B. Only when recorded in written form
    3. C. Only while the patient is in the ambulance
    4. D. After death, for a defined period
    Show answer

    Answer: D. After death, for a defined period

    Deceased patients retain privacy rights for 50 years after death.

18. A notice of privacy practices must:

    1. A. Be posted on the wall, nothing more
    2. B. Be read aloud to every patient
    3. C. Be signed by every patient before care
    4. D. Be offered to each patient
    Show answer

    Answer: D. Be offered to each patient

    It explains how patient information is used. Agencies document good-faith attempts to obtain acknowledgment.

19. A business associate agreement is required with:

    1. A. Receiving hospitals during patient hand-off
    2. B. Agency employees with records access
    3. C. Patients receiving care from the agency
    4. D. Vendors such as billing companies
    Show answer

    Answer: D. Vendors such as billing companies

    It covers vendors who handle protected health information on the agency's behalf. It extends obligations to contractors.

20. The ED nurse calls your agency the next day asking for your patient care report on a patient you transported. The patient never signed an authorization. May the agency send it?

    1. A. No; written patient authorization is always required
    2. B. Only after the patient's family approves it
    3. C. Yes; sharing with a treating provider is a treatment disclosure
    4. D. Only if a subpoena is issued first
    Show answer

    Answer: C. Yes; sharing with a treating provider is a treatment disclosure

    HIPAA allows covered entities to share protected health information with other providers for treatment without the patient's authorization, and the minimum-necessary rule does not apply to treatment disclosures. Family approval and subpoenas are not required for a treating provider to get the report.

21. Disclosing information to a patient's family:

    1. A. Is permitted if the patient does not object
    2. B. Is always prohibited without written patient consent
    3. C. Is unrestricted for any family member
    4. D. Is allowed only for the legal next of kin
    Show answer

    Answer: A. Is permitted if the patient does not object

    It is also permitted when in the patient's best interest if they are incapacitated. Use professional judgment.

22. Public health reporting of a communicable disease:

    1. A. Requires signed patient authorization
    2. B. Is permitted as a public health use
    3. C. Violates HIPAA without patient consent
    4. D. Is optional at the provider's discretion
    Show answer

    Answer: B. Is permitted as a public health use

    Required reporting overrides privacy.

23. Discussing a case for quality improvement:

    1. A. Violates HIPAA without consent
    2. B. Requires each patient's authorization
    3. C. Is prohibited outside the hospital
    4. D. Is permitted as health care operations
    Show answer

    Answer: D. Is permitted as health care operations

    Limit to necessary participants.

24. Giving a radio report that includes the patient's name:

    1. A. Is required for patient identification
    2. B. Is discouraged, since radio is not private
    3. C. Is a federal crime in every case
    4. D. Is encouraged for faster registration
    Show answer

    Answer: B. Is discouraged, since radio is not private

    Omit identifiers on the radio.

25. A breach of protected health information must be:

    1. A. Ignored if it seems minor or harmless
    2. B. Reported to the privacy officer
    3. C. Reported only to the local police
    4. D. Kept internal to protect the agency
    Show answer

    Answer: B. Reported to the privacy officer

    Breaches go to the agency privacy officer, and affected patients are notified per the Breach Notification Rule. Timelines apply.

26. Minimum necessary does NOT apply to:

    1. A. Billing and payment disclosures
    2. B. Treatment disclosures to providers
    3. C. Disclosures for research purposes
    4. D. Health care operations uses
    Show answer

    Answer: B. Treatment disclosures to providers

    Treatment communications can be complete.

27. Patients have the right to:

    1. A. Block disclosures needed for treatment
    2. B. Request restrictions on certain uses
    3. C. Rewrite the narrative of their report
    4. D. Delete records they disagree with
    Show answer

    Answer: B. Request restrictions on certain uses

    The agency need not always agree to a requested restriction. Requests are handled through a defined process.

28. Photographing a patient for documentation:

    1. A. Allowed on a personal phone if deleted later
    2. B. Is allowed without any safeguards
    3. C. Permitted under policy, treated as PHI
    4. D. Is prohibited under all circumstances
    Show answer

    Answer: C. Permitted under policy, treated as PHI

    Clinical photos may be permitted under policy, and the image is protected information. Personal phones are a major risk. Deleting later does not undo the exposure of an image on a personal phone.

29. Texting patient information between providers:

    1. A. Requires secure, compliant platforms
    2. B. Is fine on any personal phone
    3. C. Is prohibited entirely, even when encrypted
    4. D. Is allowed if names are abbreviated
    Show answer

    Answer: A. Requires secure, compliant platforms

    Standard SMS is not encrypted.

30. Leaving a patient care report visible on a screen in the hospital:

    1. A. Is a minor, harmless issue
    2. B. Is required for a proper hand-off
    3. C. Is acceptable inside a hospital
    4. D. Is an impermissible privacy exposure
    Show answer

    Answer: D. Is an impermissible privacy exposure

    Lock screens and secure devices.

31. State privacy laws may be:

    1. A. Stricter, and then they apply
    2. B. Irrelevant once HIPAA applies
    3. C. Weaker than HIPAA, never stricter
    4. D. Identical in every state
    Show answer

    Answer: A. Stricter, and then they apply

    When a state law is stricter than HIPAA, the stricter law applies. Mental health and HIV records often have extra protection.

32. Substance use treatment records have:

    1. A. No protection beyond what HIPAA provides
    2. B. Extra protection under 42 CFR Part 2
    3. C. Less protection than other records
    4. D. Protection under state law only
    Show answer

    Answer: B. Extra protection under 42 CFR Part 2

    Disclosure rules are stricter.

33. An EMS provider who accesses records of a patient they are not treating:

    1. A. Is permitted if the patient is a coworker
    2. B. Has violated privacy law
    3. C. Is allowed if done during a shift
    4. D. Is allowed if the patient is a relative
    Show answer

    Answer: B. Has violated privacy law

    It is a violation regardless of intent. Audit trails detect this. Family ties do not give access to a record.

34. Which is an appropriate response to a request for information from a patient's employer?

    1. A. Confirm only that transport occurred
    2. B. Decline; authorization is required
    3. C. Provide the requested details
    4. D. Provide a brief clinical summary
    Show answer

    Answer: B. Decline; authorization is required

    Decline and refer the request through proper channels; release requires patient authorization. Employers have no treatment relationship.

35. At a multi-vehicle crash, a TV reporter asks you whether the driver you are treating was drunk. What should you say?

    1. A. 'We can't confirm that, but he did smell like alcohol to me.'
    2. B. 'I can't share patient information; our PIO can help you.'
    3. C. 'Off the record, yes, but please don't use his name on air.'
    4. D. 'You'll have to ask the police, but I did see a beer can.'
    Show answer

    Answer: B. 'I can't share patient information; our PIO can help you.'

    Patient details, including suspected intoxication, are protected health information and may not be released to the media. Referring the reporter to the PIO is correct. Hints, 'off the record' comments, and offhand observations are still disclosures and can identify the patient.

36. In a crowded hospital elevator, your partner starts describing your last patient's overdose 'without using any names.' What should you do?

    1. A. Let it go, since no names are used
    2. B. Correct the details your partner gets wrong
    3. C. Report your partner to the privacy officer immediately
    4. D. Suggest waiting until you are somewhere private
    Show answer

    Answer: D. Suggest waiting until you are somewhere private

    Details such as time, place, age, and circumstances can identify a patient even without a name, and other people in the elevator may know the patient. Redirect the conversation to a private setting. A quiet professional reminder is the right first step. A formal report is for repeated or serious breaches. Correcting the details keeps the conversation going in public.

37. Penalties for HIPAA violations scale with:

    1. A. The patient's public status
    2. B. The level of culpability
    3. C. The state where it occurred
    4. D. The size of the agency
    Show answer

    Answer: B. The level of culpability

    Tiers range from unknowing violations to willful neglect. Knowing, wrongful disclosures can carry criminal penalties.