SNHP 220 | Midterm 1 — Fall 2026

What is policy?

A law, regulation, procedure, administrative action, incentive, or voluntary practice of governments or other institutions.

What do policy decisions often determine?

How resources are allocated.

What are the three main parts of state government?

State legislature, executive/governor, and state court system.

Can state laws preempt federal law?

No, but in health policy states can go above a federal floor.

Why are states called policy "laboratories"?

States can test policy ideas before they are adopted nationally by the federal government.

What does a state legislature do in health policy?

It can create or change laws and make budget decisions.

What do state agencies do after a policy is created?

Develop regulations and details for how the program operates, such as eligibility, covered services, outreach, and education.

What is an easy way to remember the legislature vs. state agencies?

Legislature = WHAT. Agencies = HOW.

Why is the U.S. health insurance system called a "patchwork"?

Because the U.S. has many different sources/programs of health insurance rather than one program.

What public insurance programs are mentioned in the slides?

Medicaid, CHIP, and Medicare.

Where do most people in the U.S. get health coverage?

Through their employer.

Why did employers begin offering health insurance during WWII?

Employers were restricted from raising salaries to attract workers, so they offered health insurance as a benefit instead.

What happened in 1943 that further encouraged employer-sponsored insurance?

The IRS made health insurance benefits tax-exempt.

What is the history chain behind employer-sponsored health insurance?

WWII → worker shortage → wage restrictions → employers offer health insurance → 1943 tax exemption → employer-sponsored insurance grows.

What are the three major challenges of employment-based insurance?

Expensive, locks people into jobs, and regressive.

How can employer-sponsored insurance lock people into jobs?

People may be afraid to leave their jobs because they don't want to lose health insurance.

Why is the employer-sponsored insurance tax exclusion considered regressive?

The tax break is worth more to people who make more money.

Why does the employer tax exclusion benefit lower-income people less?

Lower-income people are generally in lower tax brackets, so the tax exclusion is worth less to them.

What disadvantages do low-wage workers face with employer-sponsored insurance?

They are less likely to have employer-sponsored coverage and less likely to opt into it when offered.

What does EMTALA stand for?

Emergency Medical Treatment and Labor Act.

When was EMTALA passed?

1986.

What problem was EMTALA created to address?

Patient dumping.

What is patient dumping?

Hospitals denying care or transferring patients to charity care/public hospitals because they lack insurance or cannot pay.

Who was disproportionately affected by patient dumping?

Low-income individuals, people experiencing homelessness, and people with severe mental illness.

What hospitals does EMTALA apply to?

Hospitals with emergency departments participating in the federal Medicare program.

What basic protection does EMTALA provide?

If you go to an ER covered by EMTALA, you must be seen and evaluated.

What are the three major EMTALA requirements?

Screen → Stabilize → Transfer.

What is the screening requirement under EMTALA?

Hospitals with emergency departments must provide a screening examination to anyone who shows up.

What happens if screening identifies an emergency medical condition?

The hospital must provide stabilizing treatment.

When can a patient generally be transferred?

After the patient has been stabilized.

When can an unstable patient be transferred?

When the transfer is necessary based on clinical need.

Does EMTALA mean emergency healthcare is free?

No. Hospitals can still charge patients for care received, including uninsured patients.

In the pregnancy example, what must the ER determine?

Whether there is a medical emergency, such as active labor, and whether there is enough time to transfer the patient.

Why can EMTALA involve provider discretion?

Some determinations, such as whether someone is in active labor and whether there is time to transfer, require judgment.

Did EMTALA completely eliminate patient dumping?

No. It likely stopped the most extreme cases, but patient dumping may still occur.

Why does the professor describe EMTALA as a "band-aid on a gaping wound"?

Because the deeper problem may be people's lack of access to health insurance.

What are three reasons people may use the ER for non-emergency care?

Lack of access to primary care, lack of knowledge about other healthcare services, and difficulty knowing whether a condition is an emergency.

What does HIPAA stand for?

Health Insurance Portability and Accountability Act.

When was HIPAA passed?

1996.

When was the HIPAA Privacy Rule published?

2003.

What problem was HIPAA trying to address?

Increasing health information technology made sensitive information easier to collect and increased the potential for data breaches, while existing privacy laws could be confusing or conflicting.

What two principles does the HIPAA Privacy Rule balance?

Easing information flow to improve patient care and protecting individual data privacy.

What is HIPAA's basic privacy principle?

Covered entities cannot disclose protected health information without a person's consent unless the disclosure is explicitly permitted.

What does PHI stand for?

Protected Health Information.

What is PHI?

Identifiable information held or transmitted by a covered entity related to health conditions, care, payment for care, or identifying information.

What forms can PHI take?

Paper, oral, or electronic.

What are examples of identifying information that can be PHI?

Name, address, and Social Security number.

Is a driver's license kept by a doctor's office PHI?

Yes.

Is a medical record number PHI?

Yes.

Is a patient-portal message to a nurse practitioner PHI?

Yes.

Is diagnosis information PHI?

Yes.

According to the professor's quiz, is race/ethnicity information provided on a standardized intake form PHI?

No.

What are the three main HIPAA-covered entities?

Healthcare providers, health plans, and healthcare clearinghouses.

Which healthcare providers are covered?

Providers that electronically submit health information, including hospitals, dentists, physicians, and other practitioners.

What is a healthcare clearinghouse?

An entity that processes information for a healthcare provider or health plan, such as billing or health-management information services.

Permitted Disclosures

What three routine healthcare activities allow permitted disclosure of PHI?

Treatment, payment, and healthcare operations.

Can PHI be disclosed for public-health purposes?

Yes, certain public-interest and public-health activities are permitted.

Can PHI be disclosed for law-enforcement purposes?

According to the slides, a law-enforcement request via subpoena or court order is a permitted disclosure.

Can limited data sets be used for research?

Yes, limited data sets may be used for research, public health, or healthcare operations.

What four questions should you ask when analyzing a possible HIPAA situation?

1. Is PHI involved? → 2. Is a HIPAA-covered entity holding the data? → 3. Was there a disclosure? → 4. Does the disclosure fit an exception?

A university bookstore asks an employee for her COVID vaccine card. Does HIPAA apply according to the professor's scenario?

No. The vaccine card is PHI, but the bookstore is not a healthcare provider, health plan, or healthcare clearinghouse.

What is the lesson from the university bookstore scenario?

PHI being involved does NOT automatically mean HIPAA applies. You must check whether a covered entity is involved.

A hospital asks one of its employees for a COVID vaccine card as part of employment. Does HIPAA apply according to the scenario?

No. Although the hospital is normally a covered entity, it is acting as the person's employer, and the information is being requested for an employee record rather than as patient data.

What is the lesson from the hospital-employee scenario?

A hospital being involved doesn't automatically mean HIPAA applies; consider the role in which the hospital is acting.

A dentist asks a patient to bring a COVID vaccine card before being seen. Is simply asking for the information a HIPAA violation according to the professor's scenario?

No. The dentist is a covered entity and PHI is involved, but the dentist has not disclosed the patient's vaccine status.

What is the lesson from the dentist scenario?

PHI + covered entity does not automatically equal a HIPAA violation. Ask whether a disclosure actually occurred.

A hospital physician accesses a patient's medication list in the EHR without the patient's consent to provide treatment. Is this permitted?

Yes. PHI is involved, a covered entity holds it, and information was shared, but treatment is a permitted disclosure.

What is the lesson from the physician/EHR scenario?

Even when PHI is disclosed by a covered entity, check whether an exception/permitted disclosure applies.

What is the complete HIPAA scenario thought process?

PHI? → Covered entity? → Disclosure? → Exception? → Then determine whether the situation violates HIPAA.

Apps & Public Health

Does HIPAA automatically apply to health data stored in phone apps or wearable devices?

No.

According to the slides, when does HIPAA apply to health-app/wearable data?

When the patient shares the data with a covered entity.

What happens if the patient doesn't share the app/wearable data with a covered entity?

According to the slides, HIPAA does not apply.

In the public-health surveillance example, what does the provider do with a reportable COVID test result?

Sends it to the state or local health department.

What kind of data does the health department send to the CDC in the example?

Deidentified data.

What is the basic purpose of insurance?

To pool risk.

What does pooling risk mean?

Putting healthier and less-healthy people together so everyone pays into the same pool and healthcare costs are spread across the group.

What four methods do insurance plans use to provide care while containing costs?

Premiums, cost sharing, provider networks, and utilization management.

How can insurers use premiums to manage costs?

Use underwriting to base the amount someone pays on their likelihood of using services, such as age.

How can cost sharing control costs?

More expensive services may have higher cost sharing.

How do provider networks help insurers control costs?

Insurers contract with a smaller number of providers that offer competitive rates.

What is utilization management?

Methods such as prior authorization that limit when patients can access certain high-cost services.

Insurance Terms

What is a premium?

The amount paid for the insurance plan.

What is a deductible?

The amount the patient must pay before the plan begins paying according to its coverage rules.

What is cost sharing?

The portion of healthcare costs the patient is responsible for paying.

What is coinsurance?

Cost sharing in which the patient pays a percentage of the cost.

What is a copay?

A set dollar amount the patient pays for a covered service.

What is an out-of-pocket (OOP) maximum?

The maximum amount the patient is responsible for paying out of pocket under the plan's rules during the coverage period.

What is a provider network?

The providers with whom an insurance plan contracts.

What is a formulary?

The insurance plan's list of covered medications.

What does HSA stand for?

Health Savings Account.

What is an HSA?

A tax-advantaged savings account used to cover qualified medical expenses.

What are the tax advantages of an HSA?

Contributions are tax-deductible, funds can grow tax-free, and qualified medical expenses can be paid from the account without tax consequences.

Can employers contribute to an employee's HSA?

Yes, some employers do.

What type of insurance plan may be paired with an HSA?

A high-deductible health plan.

What is prior authorization used for?

It is a form of utilization management used to limit when patients can access certain high-cost services.

What are the benefits of prior authorization listed in the slides?

Limit access to cost-effective options, ensure patient safety, and keep premiums low.

What are the disadvantages of prior authorization?

It can limit patient choice and individualized treatment, prioritize cost over clinical standards of care, and create administrative barriers for patients and providers.

What are examples of policies that could reform prior authorization?

Prohibit some or all PA, lengthen how long authorization remains valid, require expert clinicians to review requests, reduce PA requirements for providers with strong approval records, or require greater transparency about criteria and denials.

What are the three problems with employment-based insurance?

Expensive → Locks people into jobs → Regressive.

What is the EMTALA sequence?

Screen → Stabilize → Transfer.