Question

what should be verified when someone requests phi for tpo purposes?

multiple choice

the persons authority to access phi and signed acknowledgment of receipt of notice of privacy practices

the identity of the person and signed acknowledgment of receipt of notice of privacy practices

signed acknowledgment of receipt of notice of privacy practices

the identity of the person and persons authority to access phi

Explanation:

Define TPO and verification requirements

Under the HIPAA Privacy Rule, Protected Health Information (PHI) can be disclosed without explicit patient authorization for Treatment, Payment, and Healthcare Operations (TPO). However, before releasing any PHI, a covered entity must verify the identity of the person requesting the information and their authority to access that PHI.

Analyze the role of Notice of Privacy Practices

The Notice of Privacy Practices (NPP) is a document provided to patients explaining how their PHI may be used and disclosed. While obtaining a signed acknowledgment of receipt of the NPP is a standard administrative requirement during patient intake, it is not a verification step required of an external individual or entity requesting PHI for TPO purposes.

Evaluate the given options

• Option 1: "the person's authority to access PHI and signed acknowledgment of receipt of notice of privacy practices" — Incorrect, as the signed NPP acknowledgment is not part of the verification process for a TPO request.
• Option 2: "the identity of the person and signed acknowledgment of receipt of notice of privacy practices" — Incorrect, for the same reason regarding the NPP acknowledgment.
• Option 3: "signed acknowledgment of receipt of notice of privacy practices" — Incorrect, as this does not verify identity or authority.
• Option 4: "the identity of the person and person's authority to access PHI" — Correct, as verifying both identity and authority is the standard administrative safeguard required under HIPAA before disclosing PHI.

Answer:

• (A) the person's authority to access PHI and signed acknowledgment of receipt of notice of privacy practices
• (B) the identity of the person and signed acknowledgment of receipt of notice of privacy practices
• (C) signed acknowledgment of receipt of notice of privacy practices
• (D) the identity of the person and person's authority to access PHI (Correct answer)