HIPAA and patient consent for medical assistants

Medical Law and Ethics is the smallest domain on the NHA CCMA exam, 7 of 150 scored items, but HIPAA does not stay inside it. Privacy shows up in the administrative, communication and lab-reporting items too, so the law unit earns more than its 4.7% share of your attention. This post follows unit 6 of the free NHA CCMA course, which reads HIPAA from the regulation text itself (45 CFR Parts 160 and 164) rather than from summaries. It is a study aid, not legal or clinical guidance; the provider obtains consent and makes legal judgments, and office policy and state law govern what the MA does.

Who HIPAA covers

HIPAA's covered entities are health plans, health care clearinghouses, and health care providers who send health information electronically in a standard transaction such as a claim. A business associate, such as a billing service or shredding vendor, handles protected health information on a covered entity's behalf. "Workforce" includes employees, volunteers and trainees, paid or not, so an MA student on externship is bound by HIPAA from day one.

Privacy Rule versus Security Rule

The Privacy Rule governs uses and disclosures of protected health information (PHI) in any form: paper, spoken or electronic. The Security Rule protects only electronic PHI (ePHI). That one-line distinction is a reliable exam item.

Security Rule safeguards come in three groups, and the exam likes to hand you an example and ask which group it belongs to.

So a locked records room is a physical safeguard, automatic logoff is technical, and staff training is administrative. HIPAA policies and required records are kept for 6 years.

PHI, use, disclosure and minimum necessary

PHI is individually identifiable health information about a person's health, care or payment for care, including demographics, in any form. It stops being PHI when all 18 safe-harbor identifiers (names, addresses smaller than a state, dates other than year, phone numbers, record numbers, full-face photos and so on) are removed. A deceased patient's PHI stays protected for 50 years after death.

A use is sharing or examining PHI inside the entity. A disclosure releases it outside. A covered entity may use and disclose PHI for treatment, payment and health care operations (TPO) without a signed authorization; sending records to a referred specialist or claim information to an insurer needs no form.

Minimum necessary means the workforce uses, discloses or requests only the PHI needed for the purpose, with access limited by job role, and a whole record is not released unless the entire record is justified. It does not apply to disclosures to a provider for treatment, to the patient, under an authorization, to HHS, or when required by law. The distractor is the referral: sending a treating specialist what they need is the treatment exception, not a violation.

Authorizations and patient rights

A signed authorization is required for disclosures not otherwise permitted, including most uses of psychotherapy notes, marketing and the sale of PHI. A valid one states what is released, by whom, to whom, for what purpose and until when, carries the patient's dated signature, and tells the patient they may revoke in writing.

The rights the exam asks about:

• Notice of Privacy Practices: given no later than the first service date, with a good-faith effort to get written acknowledgment. A patient who refuses to sign still gets treated; the staff member documents the attempt.
• Right of access: as of 2026 the entity acts within 30 days, with one 30-day extension explained in writing. Copies come in the form requested when readily producible, and the fee is cost-based, limited to copying labor, supplies, postage and an agreed summary.
• Right to request restrictions: the office need not agree, except it must not send information to a health plan when the patient paid in full out of pocket for that service.

Family and friends involved in care may be told relevant information if the patient is present and agrees or does not object. Disclosures permitted without authorization in the public interest include those required by law, public health reporting, abuse and neglect reports, court orders and workers' compensation. Office lab results follow the same rule, going only to authorized people, which is why CLIA waived tests for medical assistants ends with HIPAA.

An impermissible use or disclosure of PHI is presumed to be a breach unless a risk assessment shows a low probability of compromise, and affected individuals are notified no later than 60 calendar days after discovery. The MA's job when PHI is misdirected, say a fax to the wrong number, is to report it promptly to the supervisor or privacy officer, who runs the risk assessment.

Consent

Federal hospital rules give patients the right to make informed decisions, request or refuse treatment, and formulate advance directives. The vocabulary the exam uses:

• Implied consent is shown by the patient's actions, such as rolling up a sleeve for an injection, rather than stated.
• Expressed consent is stated in words or in writing. Which procedures need a signed form is set by office policy and state law.
• Informed consent means the patient decides after being told about the treatment options and their risks, the involvement in care that both the AHA Patient Care Partnership and the federal hospital rules promise patients. Obtaining it is the provider's responsibility, not the MA's. A general consent-to-treat signed at registration is not informed consent for a specific invasive procedure.

Performing a procedure without consent, or beyond it, can be battery; the classic case is a surgeon who operated on the wrong ear. The right to refuse treatment includes refusing after first agreeing.

Minors generally cannot consent; a parent or legal guardian does, and the age of majority is 18 in most states. An emancipated minor, freed from parental control by marriage, military service or a court order, consents to their own care. Under HIPAA a parent is usually the minor's personal representative, but the minor controls information about care the minor lawfully consented to alone under state law. Those state rules sit outside the certification itself; as CCMA eligibility, retakes and renewal explains, the CCMA is a certification, not a state license.

Advance directives

An advance directive states what care a person accepts or refuses if they become unable to speak for themselves. A living will records wishes about treatments such as CPR, tube feeding and ventilation; it cannot name a decision-maker. A durable power of attorney for health care (health care proxy or agent) names who decides when the patient cannot, with no power over finances. The shorthand: the living will says what, the proxy says who. "Durable" means the power survives incapacity; an ordinary power of attorney ends there.

A DNR is a medical order written by a provider after discussion with the patient, proxy or family. It covers CPR only, and the patient can change their mind at any time. POLST is a provider-signed portable order set for seriously ill or frail people near the end of life, not a substitute advance directive for a healthy adult. A guardian is appointed by a court, whereas a health care agent is chosen by the patient in advance.

The MA's role is to ask at intake whether the patient has an advance directive, scan a copy into the chart per office policy, and flag it for the provider, never to advise what to choose.

Mandatory reporting concepts

HIPAA permits disclosure without authorization for reports required by law, such as communicable disease reports to public health and child abuse reports to authorized agencies. State law decides who must report and to whom, and NHA's own test plans list child abuse, STIs, gunshot wounds and communicable diseases as information that is not private from authorities.

Child abuse and neglect is harm or threat of harm to a child under 18 by a parent or caregiver; the four common types are physical, sexual and emotional abuse and neglect. Elder abuse is an act or failure to act by a caregiver or trusted person that harms an adult aged 60 or older, and its types add financial exploitation, abandonment and self-neglect. A person who suspects elder abuse does not need to prove it, only report the suspicion. In the office, the MA documents objective findings and the patient's own words, tells the provider promptly, follows protocol and state law, and does not confront a suspected abuser.

Studying the law unit

This unit is dense with numbers that look alike: 30 days for access, 60 for breach notices, 6 years for documentation, 50 years after death. How to memorize a list, a table or a formula sheet is the method for keeping them apart, and what spaced repetition actually does explains why they need review over weeks. The same unit covers the Controlled Substances Act, laid out in DEA controlled substance schedules, and HIPAA appears on the phlebotomy certification too, in what's on the NHA CPT exam.

For the CCMA itself, what's on the NHA CCMA exam shows how Medical Law and Ethics sits against the clinical domains, and the study schedule generator will size the week you give it. Unit 6 of the NHA CCMA flashcard course covers everything above, and CCMA practice questions shows how it gets asked.