In this month's HIPAA Q&A, our expert answers questions on medical record requests, health insurance exchanges, fines when there has been no breach of PHI, and mandatory encryption.
Q: What is the difference between ICD-10-CM code I24.8 (other forms of acute ischemic heart disease) and code I21.A1 (myocardial infarction type 2)? In which situation would each of these codes be reported?
Q: Is it a reportable breach if an entity had the ability to send encrypted email, but an unencrypted email was sent to the correct recipient because of a computer fluke or user error?
Q: A physician performs a hemiarthroplasty for a hip fracture. Would this procedure be reported with CPT code 27125 (hemiarthroplasty, hip, partial [e.g., femoral stem prosthesis, bipolar arthroplasty])?
Q: My child’s school requires parents to send a doctor’s note when a student is out sick for more than two days. After providing this note for my child, their teacher spoke to me and mentioned information she could only have learned if she had read the note. Is this a HIPAA violation? Are schools covered by HIPAA if they request doctor's notes?
Q: Can you bill CPT codes 76981 (ultrasound, elastography; parenchyma [e.g., organ]) and 76982 (ultrasound, elastography; first target lesion) at the same time as CPT codes for liver and breast ultrasounds?
