HIM 320 Practice Questions with Verified
Answers Graded A+ | Assured Success
use and disclosure for marketing purposes
-healthcare organizations may wish to use patient health information for the purpose of
marketing their disease specific goods and services or for the purposes of assisting external
vendors in marketing their products or services
-the privacy rule requires covered entities to obtain the patient's authorization for the use or
disclosure of PHI for marketing purposes
the privacy rule defines marketing as:
a communication about a product or service that encourages the recipient of the communication
to purchase or use the product or services
if the use or disclosure fits the definition of "marketing", the covered entity must obtain an
authorization except in certain cases
communications are considered to be marketing unless they:
-describe a health-related product or service provided by or included in the benefit plan of the CE
making the communication
-describe replacements or enhancements to a health plan
-describe health-related products or services that are of value, although not part of the benefit
plan
-are for the treatment of the individual
, -are for case management or coordination of care of the individual
-are refill reminders
marketing communications that do not require an authorization include:
-marketing done face-to-face with the individual
-consists of a gift of nominal value provided by the CE
use and disclosure for fundraising
-for fundraising activities that benefit the CE, the privacy rule permits the CE to use or disclose
information to a business associate or institutionally related foundation
-if fundraising activity targets individuals based on diagnosis, prior authorization is required
to use PHI for fundraising without obtaining authorization, the covered entity must take all
of the following actions:
-include in the notice of privacy practices a statement that it may contact the individual to raise
funds
-include in its fund-raising materials a description of how the individual may opt out of receiving
future solicitations
-for those who opt out, making reasonable efforts to protect them from receiving any future fund-
raising materials
sale of PHI
HITECH prohibits both CEs and BAs from selling PHI without patient authorization
ARRA revisions - sale of PHI
Answers Graded A+ | Assured Success
use and disclosure for marketing purposes
-healthcare organizations may wish to use patient health information for the purpose of
marketing their disease specific goods and services or for the purposes of assisting external
vendors in marketing their products or services
-the privacy rule requires covered entities to obtain the patient's authorization for the use or
disclosure of PHI for marketing purposes
the privacy rule defines marketing as:
a communication about a product or service that encourages the recipient of the communication
to purchase or use the product or services
if the use or disclosure fits the definition of "marketing", the covered entity must obtain an
authorization except in certain cases
communications are considered to be marketing unless they:
-describe a health-related product or service provided by or included in the benefit plan of the CE
making the communication
-describe replacements or enhancements to a health plan
-describe health-related products or services that are of value, although not part of the benefit
plan
-are for the treatment of the individual
, -are for case management or coordination of care of the individual
-are refill reminders
marketing communications that do not require an authorization include:
-marketing done face-to-face with the individual
-consists of a gift of nominal value provided by the CE
use and disclosure for fundraising
-for fundraising activities that benefit the CE, the privacy rule permits the CE to use or disclose
information to a business associate or institutionally related foundation
-if fundraising activity targets individuals based on diagnosis, prior authorization is required
to use PHI for fundraising without obtaining authorization, the covered entity must take all
of the following actions:
-include in the notice of privacy practices a statement that it may contact the individual to raise
funds
-include in its fund-raising materials a description of how the individual may opt out of receiving
future solicitations
-for those who opt out, making reasonable efforts to protect them from receiving any future fund-
raising materials
sale of PHI
HITECH prohibits both CEs and BAs from selling PHI without patient authorization
ARRA revisions - sale of PHI
