HIPAA, HIV Consent, and Medical Privacy Practice Questions

A life applicant's doctor holds a treatment record and the life insurer wants it for underwriting. A colleague says the ordinary life insurer must be the HIPAA covered entity because it asked for health data. Which answer is more accurate?

1. The covered physician or health system is generally bound by HIPAA; the life insurer is not automatically a covered entity merely because it sells life insurance.
2. Every company that asks a medical question is a HIPAA covered entity.
3. HIPAA never applies to the physician's records.
4. Only the applicant's employer can authorize disclosure.

An agent calls a clinic and asks for an applicant's full chart to speed underwriting. The clinic is a HIPAA covered provider. The applicant has not signed a medical-record authorization. What is the best next step?

1. Send the chart because a life application is pending.
2. Obtain an appropriate written HIPAA authorization and use the insurer's approved records process.
3. Ask the applicant's coworker to collect the chart.
4. Tell the clinic that the insurer's premium quote overrides privacy law.

An applicant verbally says, 'Sure, look at my medical history.' A covered provider asks whether this is enough to release records to a life insurer under HIPAA. Which answer is best?

1. Yes; any verbal agreement replaces the required authorization.
2. No; where HIPAA authorization is required, a casual verbal consent is not a substitute for a valid authorization.
3. Yes, but only if the applicant says it twice.
4. No; a life insurer may never obtain medical records.

A Texas life insurer asks a proposed insured to take an HIV-related test as part of an application. The agent says the test can occur without telling the proposed insured because the applicant already answered a health questionnaire. What is the correct response?

1. The proposed insured must be told of the test and written authorization obtained as Texas rules require.
2. A health questionnaire automatically authorizes every possible test.
3. The beneficiary alone approves all HIV tests.
4. Testing is prohibited even with authorization.

The agent places a one-sentence HIV test permission inside a dense multipage sales brochure, with no separate notice. The proposed insured signs the brochure. What issue should the agent flag?

1. No issue; any signature anywhere fulfills all Texas testing requirements.
2. Texas's insurance rule calls for its Notice and Consent for HIV-Related Testing form, printed separately with required language.
3. The physician must become the policy beneficiary.
4. A brochure can never contain insurance information.

A business owns a proposed key-person life policy on its employee. The company manager signs the application and asks the agent to arrange an HIV-related test on the employee without speaking to the employee. Which response fits the Texas rule?

1. The manager's signature is always enough because the business pays premiums.
2. The proposed insured, or a person legally authorized to consent for them, must receive the test disclosure and give written authorization.
3. The test is automatically ordered whenever coverage exceeds $50,000.
4. The beneficiary's signature alone controls all testing.

An agent receives a confidential underwriting update containing medical details and wants to forward the full message to a prospective employer who asked whether the person will qualify for life coverage. No disclosure authorization covers the employer. What is the best action?

1. Forward it because the employer is curious about the outcome.
2. Do not disclose the medical details; use the insurer's approved privacy and communication process.
3. Post an anonymized version on a public forum with the person's initials.
4. Forward it if the employer promises to delete it after reading.

A clinic receives a records request from an insurer using an authorization that expired several months earlier. The agent argues that the applicant once signed it, so it can never expire. Which response is best?

1. Use it forever because a life policy could last decades.
2. Review and obtain a currently valid authorization before the covered provider discloses under that request.
3. Have a beneficiary sign the old form for the applicant.
4. Ask the clinic to send records anonymously but include the applicant's policy number.

A covered provider holds a valid HIPAA authorization to send named records to a life insurer for underwriting. An agent says the HIPAA minimum necessary standard always restricts the provider to one sentence even when the authorization clearly names the records. Which answer is best?

1. HHS says individual-authorized disclosures are exempt from the HIPAA minimum necessary requirement, though the disclosure must fit the authorization.
2. The provider may publish the entire record online.
3. An authorization has no defined scope.
4. The life insurer may demand unrelated family members' records without their permission.

An underwriting record says an applicant sought counseling after worrying about possible HIV exposure. It does not show a diagnosis or positive test. An agent says counseling alone proves the applicant has HIV and should be rejected. Which response is most accurate?

1. Correct; concern itself proves infection.
2. Incorrect; Texas rules restrict adverse decisions based solely on records showing AIDS-related concerns and counseling, subject to the rule's terms.
3. Correct if the policy is term life.
4. The agent may alter the record to avoid review.

A health care provider has an applicant's HIPAA authorization to send specified records to a life insurer for underwriting. The agent suggests using those records to create a targeted advertisement for a different product. Which answer is best?

1. The underwriting authorization automatically permits any future marketing use by anyone.
2. The specified authorization does not by itself authorize unrelated marketing use; follow applicable privacy law, form scope, and carrier policy.
3. Medical records are public after one disclosure.
4. Marketing is allowed only when the applicant has a low premium.

An applicant discloses a condition relevant to life underwriting but worries about privacy. The agent proposes omitting it so fewer people will see it. What should the agent do?

1. Omit it whenever privacy is mentioned.
2. Explain the legitimate underwriting request, obtain required authorizations, use secure approved channels, and submit accurate answers.
3. Post the details publicly to show transparency.
4. Ask the applicant to let a friend answer medical questions instead.