Legal & Ethical Considerations

1. A patient calls the medical office and asks the medical assistant to fax her recent lab results to her new primary care physician. What must the medical assistant do before releasing the records?

HIPAA requires a signed, written authorization before releasing PHI to a third party, even at the patient's request. Verbal authorization alone is not sufficient. Records can be shared with other providers for continuity of care, but proper documentation must be obtained first.

2. A 16-year-old patient arrives at the clinic requesting treatment for a sexually transmitted infection without her parents' knowledge. Which legal concept most likely allows her to consent to this treatment?

The mature minor doctrine allows minors to consent to certain sensitive treatments such as STI care, contraception, or substance abuse treatment without parental consent in many states. Respondeat superior applies to employer liability. Implied consent applies to emergencies. Good Samaritan laws protect volunteer rescuers from liability.

3. A physician stops treating a patient without proper notification while the patient still requires medical care. This is an example of which tort?

Abandonment occurs when a physician terminates the patient-physician relationship without proper notice while the patient still requires care. Assault is the threat of harm, battery is unauthorized touching, and slander is spoken defamation.

4. Which of the following is a requirement of the HITECH Act?

The HITECH Act strengthened HIPAA by requiring providers to notify affected patients (and HHS) when there is a breach of unsecured PHI. Records retention varies by state law. Patients have the right to electronic copies of their records, often at minimal cost. Multiple authorized staff, not only physicians, may access EHRs.

5. A medical assistant witnesses a coworker discussing a celebrity patient's diagnosis in the break room. What is the most appropriate action?

Discussing PHI in areas where others may overhear is a HIPAA violation and must be reported to the privacy officer or supervisor. Break rooms are not considered secure areas. Joining the conversation compounds the violation, and simply warning the coworker does not fulfill mandatory reporting obligations.

6. Which document allows a patient to designate another person to make healthcare decisions on their behalf if they become incapacitated?

A medical durable power of attorney designates a healthcare proxy to make decisions when the patient cannot. A living will specifies treatment preferences but does not appoint a decision-maker. A DNR order applies to resuscitation only. Informed consent applies to specific procedures.

7. A patient is brought unconscious to the emergency department after a car accident. The medical team begins life-saving treatment without formal consent. This is legally justified under which principle?

Implied consent applies in emergency situations when a patient cannot provide consent and delay would result in harm or death. Written, informed, and expressed consent all require the patient's active participation, which is not possible when the patient is unconscious.

8. The Genetic Information Nondiscrimination Act (GINA) primarily protects patients from discrimination in which two areas?

GINA protects individuals from discrimination based on genetic information in health insurance coverage and employment decisions. It does not address housing, education, voting, marriage, or adoption.

9. A medical assistant receives a subpoena to appear in court regarding a patient's care. What should the medical assistant do first?

A subpoena is a legal order that must be addressed appropriately, but the medical assistant should notify the physician and office manager (and likely legal counsel) before responding. Ignoring a subpoena is unlawful. Releasing records without proper legal review may violate HIPAA. Contacting the patient is not the first step.

10. Which of the following is a mandatory report that must be filed by healthcare providers in all states?

Suspected child abuse is a mandatory report in all 50 states. Changing physicians, refusing vaccinations, and elective cosmetic procedures are not mandatory reports. Other mandatory reports include certain communicable diseases, wounds of violence, and elder/dependent adult abuse.

1. Which drug schedule includes substances with the highest potential for abuse and no accepted medical use in the United States?

Schedule I substances (e.g., heroin, LSD) have high abuse potential and no accepted medical use. Schedule II drugs have high abuse potential but accepted medical use (e.g., morphine). Schedules III–V have progressively lower abuse potential.

2. The Patient Self-Determination Act (PSDA) requires healthcare facilities that receive Medicare and Medicaid funding to do which of the following?

The PSDA requires facilities receiving Medicare/Medicaid funds to inform patients of their right to make advance directives and to have those documented. It does not mandate free care, require DNR orders, or address death reporting.

3. A medical assistant improperly administers an injection because they were not properly trained. Under which legal doctrine can the employing physician also be held liable?

Respondeat superior ("let the master answer") holds employers liable for the acts of their employees performed within the scope of employment. Res ipsa loquitur means "the thing speaks for itself." Stare decisis refers to legal precedent. Good Samaritan laws protect volunteer emergency responders.

4. Which of the following is the BEST method to ensure security of PHI during electronic transmission?

Encryption and password protection safeguard PHI during electronic transmission. Personal email accounts are not secure. Faxing to unverified numbers risks misdirected PHI. Sharing login credentials violates HIPAA security requirements and eliminates individual accountability via activity logs.

5. A medical assistant tells a patient in the waiting room, loudly enough for others to hear, that another patient "probably has HIV." This statement, if false and damaging, could constitute which tort?

Slander is spoken defamation that damages a person's reputation. Libel is written defamation. Battery is unauthorized physical contact. Negligence is failure to exercise reasonable care.

6. A patient requests to review and amend their medical record because they believe there is an error. Under HIPAA, what right does the patient have?

HIPAA grants patients the right to inspect and request amendments to their PHI. Providers may deny the request under certain conditions but must explain the denial. Patients cannot delete records or alter them directly; providers control the record but must consider amendment requests.

7. Which of the following requires a separate, specific written authorization for release, beyond a general medical records release?

HIV information, mental health records, and drug/alcohol treatment records typically require separate, specific written authorization due to their sensitive nature. Immunization records, physical exam notes, and vital sign records are generally covered under a standard release.

8. Which of the following is required for informed consent to be valid?

Valid informed consent requires the patient to understand the nature of the procedure, its risks, benefits, and alternatives, and to voluntarily agree. Family members need not be present. Physicians cannot guarantee outcomes. A single witness is typically sufficient.

9. A physician wishes to terminate the patient-physician relationship due to noncompliance. Which action helps avoid a claim of abandonment?

To properly terminate care, the physician should send a written notice (typically certified mail with return receipt), provide reasonable notice (often 30 days) for the patient to find another provider, and offer emergency care during the transition. Verbal notice, ignoring the patient, or destroying records are not appropriate and may support an abandonment claim.

10. According to the Patient Care Partnership (formerly the Patients' Bill of Rights), patients have the right to:

The Patient Care Partnership outlines patient rights including high-quality hospital care, a clean and safe environment, involvement in care decisions, protection of privacy, help when leaving the hospital, and help with billing claims. It does not entitle patients to demand any treatment, access other patients' records, or receive all care regardless of payment.

1. A medical assistant discusses a patient's lab results with a coworker in the elevator where other people can hear. Which HIPAA violation has occurred?

Discussing PHI in a public area where others can overhear is a breach of verbal confidentiality under HIPAA. Written PHI was not disclosed, informed consent relates to procedures, and Good Samaritan laws address emergency care by bystanders.

2. Under the HITECH Act, what must a covered entity do when a breach of unsecured PHI affects more than 500 individuals?

The HITECH Act requires notification of affected individuals, the Department of Health and Human Services (HHS), and prominent media outlets when a breach affects more than 500 individuals in a state or jurisdiction. Delayed or limited reporting violates the statute.

3. A 16-year-old patient who lives independently, is married, and financially supports herself arrives for treatment. She may legally consent to her own care because she is considered:

An emancipated minor is a minor who is legally independent of parents, often through marriage, military service, or court order, and can consent to their own medical care. A mature minor doctrine allows some minors to consent to specific treatments but does not confer full independence. Dependent adult and ward of the court do not apply.

4. A physician stops seeing a patient without proper notification, and the patient suffers harm as a result. This is an example of which tort?

Abandonment occurs when a physician terminates the physician-patient relationship without reasonable notice or arrangement for continued care, resulting in harm. Assault is the threat of harm, battery is unauthorized touching, and slander is spoken defamation.

5. A medical assistant receives a subpoena duces tecum. What does this legal document require?

A subpoena duces tecum is a court order requiring the production of specified documents or records, such as medical records. A regular subpoena requires personal appearance to testify. It does not involve arrest or fines.

6. Which of the following situations requires specific written authorization from the patient before disclosure, even for continuity of care?

HIV-related information, along with drug/alcohol treatment records, mental health records, and genetic information, typically requires specific written authorization even for continuity of care. Routine sharing among treating providers for treatment purposes is generally permitted under HIPAA without additional authorization.

7. The Genetic Information Nondiscrimination Act (GINA) primarily prohibits discrimination based on genetic information in which two areas?

GINA prohibits discrimination based on genetic information in health insurance and employment decisions. It does not apply to housing, education, voting, or other areas listed.

8. A patient signs a consent form after the physician explains the risks, benefits, and alternatives of a proposed surgery. This represents:

Informed consent requires that the patient be given information about the procedure, risks, benefits, and alternatives before agreeing in writing. Implied consent is inferred from actions, verbal consent lacks written documentation, and emergency consent applies when the patient cannot consent and treatment is urgent.

9. Which legal doctrine holds an employer responsible for the actions of employees performed within the scope of their employment?

Respondeat superior means 'let the master answer' and holds employers liable for employees' negligent acts within their scope of employment. Res ipsa loquitur means 'the thing speaks for itself,' stare decisis refers to precedent, and habeas corpus relates to unlawful detention.

10. Which of the following is a mandatory report that a medical assistant or physician must make to public health authorities?

Communicable diseases such as tuberculosis are mandatory reportable conditions to public health authorities. Changes in providers, insurance, or vaccine refusal are not reportable events.

1. A patient's advance directive states 'Do Not Resuscitate' (DNR). What action should be taken if the patient goes into cardiac arrest in the medical office?

A valid DNR order must be honored, meaning resuscitative measures are withheld and comfort care provided. Performing CPR would violate the patient's expressed wishes. Family permission is not required to honor a legally executed DNR.

2. The Patient Self-Determination Act (PSDA) requires health care facilities to:

The PSDA requires health care facilities receiving Medicare/Medicaid funds to inform patients of their rights to make health care decisions and execute advance directives. The other options are not PSDA requirements.

3. Which of the following is an example of appropriate disposal of PHI?

Shredding paper records ensures PHI cannot be reconstructed or accessed by unauthorized individuals, complying with HIPAA. Recycling, unlocked storage, and emailing to personal accounts all risk unauthorized disclosure.

4. A medical assistant tells a coworker that a specific patient has a sexually transmitted infection, and this statement is untrue and damages the patient's reputation. This is an example of:

Slander is spoken defamation that harms someone's reputation. Libel is written defamation. Battery is unauthorized physical contact, and negligence is failure to meet a standard of care.

5. Which schedule of controlled substances has the highest potential for abuse and no accepted medical use in the United States?

Schedule I drugs (e.g., heroin, LSD) have the highest abuse potential and no accepted medical use. Schedule II drugs have high abuse potential but accepted medical use. Schedules III and IV have progressively lower abuse potential.

6. A medical assistant witnesses signs of physical abuse on a 6-year-old patient. What is the medical assistant's legal obligation?

Medical assistants and other health care workers are mandatory reporters of suspected child abuse and must report suspicions to appropriate authorities such as child protective services. Confronting the parent, ignoring findings, or only documenting are not legally sufficient responses.

7. Which security measure best protects electronic PHI during transmission over the internet?

Encryption converts data into a coded format that unauthorized users cannot read, protecting PHI during transmission. Antivirus software protects against malware, screen savers protect displayed information, and fax cover sheets are for paper transmissions.

8. A physician wishes to terminate care with a difficult patient. Which action is required to avoid a claim of abandonment?

To properly terminate the physician-patient relationship, the physician must send written notice (usually certified mail), provide reasons if appropriate, allow reasonable time to find another provider (typically 30 days), and offer to transfer records. The other options could constitute abandonment.

9. An unconscious patient is brought to the office after collapsing. Treatment is initiated without formal consent under which principle?

In an emergency where the patient cannot communicate, consent to life-saving treatment is implied under the assumption that a reasonable person would want care. Informed, written, and expressed consent all require patient participation.

10. Under HIPAA, a patient has the right to do all of the following with their medical record EXCEPT:

Patients cannot permanently delete portions of their medical record because the record is a legal document. HIPAA grants patients the right to inspect, copy, request amendments (which the provider may accept or deny with documentation), and request restrictions on use/disclosure.

1. A patient calls the medical office and requests that a copy of her recent lab results be faxed to her personal number. According to HIPAA, what is the most appropriate action for the medical assistant?

HIPAA requires written authorization from the patient before releasing protected health information, even when the patient is requesting their own records be sent elsewhere. A verbal request alone is insufficient documentation. Patients absolutely have the right to access their records, but proper authorization procedures must be followed. Physician verification is not required for a patient's own record request.

2. A 16-year-old arrives at the clinic alone requesting treatment for a sexually transmitted infection. Which legal concept most likely allows the medical assistant to proceed with intake without parental consent?

The mature minor doctrine allows minors to consent to certain medical treatments, including STI testing and treatment, without parental involvement in most states. Respondeat superior refers to employer liability for employee actions. Good Samaritan laws protect those rendering emergency aid. Implied consent applies when a patient's actions suggest consent, such as rolling up a sleeve for a blood draw.

3. A physician verbally tells a patient she will continue to treat him but then stops returning his calls and refuses to see him without providing written notice. This situation could constitute which tort?

Abandonment occurs when a physician terminates the patient-physician relationship without proper written notice and without allowing time for the patient to find another provider. Battery involves unauthorized touching. Slander is spoken defamation. Assault is the threat of harm causing apprehension.

4. A medical assistant is asked to dispose of paper documents containing PHI at the end of the day. Which method complies with HIPAA requirements?

HIPAA requires that PHI be rendered unreadable and unable to be reconstructed; cross-cut shredding meets this standard. Regular trash and recycling bins do not destroy the information and allow unauthorized access. Storing PHI in unlocked cabinets violates security requirements for safeguarding protected information.

5. A patient brings in a document naming her daughter to make medical decisions if she becomes incapacitated. This document is known as a:

A medical durable power of attorney appoints a specific person (healthcare proxy) to make medical decisions when the patient cannot. A living will documents the patient's own wishes regarding end-of-life care such as DNR/DNI instructions. A DNR is a specific order about resuscitation. The PSDA is federal legislation requiring facilities to inform patients about advance directive options.

6. During a home visit, a medical assistant observes bruises in various stages of healing on an 82-year-old patient and suspects the caregiver is abusive. What is the medical assistant's legal obligation?

Medical assistants are mandatory reporters and must report suspected elder abuse to Adult Protective Services or the appropriate state agency. Only a reasonable suspicion is required to report—not proof. Confronting the caregiver could endanger the patient. Documenting alone without reporting fails to fulfill the legal obligation.

7. A medical office is transitioning to electronic health records. Which security measure specifically protects PHI from unauthorized external network access?

A firewall blocks unauthorized external network access to protect the internal system from outside intrusion. An activity log tracks who accessed which records for auditing purposes. Encryption scrambles data so it cannot be read if intercepted during transmission. Passwords authenticate individual users but do not block external network threats.

8. A physician instructs a medical assistant to administer an injection to a patient. The medical assistant administers the wrong medication, harming the patient. Under which legal doctrine may the physician also be held liable?

Respondeat superior ('let the master answer') holds employers liable for the negligent acts of employees performed within the scope of employment. Res ipsa loquitur ('the thing speaks for itself') applies when negligence is obvious. Stare decisis refers to legal precedent. Subpoena duces tecum is a court order to produce documents.

9. A patient's employer calls the office asking about the patient's recent HIV test results, stating the information is needed for insurance purposes. What is the correct response from the medical assistant?

HIV-related information requires specific written authorization from the patient before it can be released to any third party, including employers. Even confirming that testing occurred violates confidentiality. The employer's involvement with insurance does not grant automatic access. Referring to the physician does not solve the underlying confidentiality issue—no one in the office may release PHI without proper authorization.

10. Which of the following is classified as a Schedule II controlled substance requiring the strictest prescription controls?

Oxycodone is a Schedule II controlled substance with high abuse potential; prescriptions cannot be refilled and often require specific handling procedures. Diazepam and alprazolam are Schedule IV benzodiazepines with lower abuse potential. Cough preparations with limited codeine are typically Schedule V, which have the lowest abuse potential among controlled substances.