In the MRT privacy obligations, which document outlines requirements?

• A. The institution's informal guidelines.
• B. The patient’s medical consent form.
• C. HIPAA and state privacy laws.
• D. Vendor warranty terms.

Answer: (C)

Privacy obligations for MRTs are defined by law and regulatory standards that govern how protected health information can be used, shared, and protected. The federal standard, HIPAA, sets the baseline for privacy and security of patient information, defines what counts as protected health information, who may access it, and the rights patients have over their data, along with security measures and breach notification. States can add or tighten protections with additional privacy laws. Together, these statutes outline what MRTs must do to safeguard patient information.

Informal guidelines aren’t legally binding requirements, so they don’t establish the mandatory rules you must follow. A patient consent form is about authorizing specific disclosures of information, not the full set of privacy protections that apply to all PHI. Vendor warranty terms deal with product performance and warranties, not privacy obligations.