HIPAA Privacy and Security Flashcards
7 cards from real AHIMA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 HIPAA Privacy and Security flashcards as text
Which of the following is TRUE about the HIPAA 'Right to Restrict' disclosures?
Answer: Covered entities must honor a restriction if the patient pays out-of-pocket in full for a service
Under the 2013 Omnibus Rule, covered entities must honor a patient's request to restrict disclosure to a health plan when the patient pays out-of-pocket in full for the service.
Which HIPAA civil monetary penalty tier applies to violations where the covered entity was unaware and could not have known of the violation even with reasonable diligence?
Answer: Tier 1 — $100 to $50,000 per violation
Tier 1 penalties ($100–$50,000 per violation) apply when the entity did not know and, with reasonable diligence, could not have known of the HIPAA violation.
Under HIPAA, which of the following describes a Hybrid Entity?
Answer: An organization that performs both covered and non-covered healthcare functions and designates its covered components
A hybrid entity is a single legal entity that performs both HIPAA-covered and non-covered functions and formally designates its healthcare components.
When a covered entity uses or discloses PHI for marketing purposes, HIPAA generally requires:
Answer: Patient authorization unless it is a face-to-face communication or a promotional gift of nominal value
HIPAA requires patient authorization for marketing uses of PHI, with narrow exceptions for face-to-face communications and promotional gifts of nominal value.
Which of the following is an example of a HIPAA technical safeguard?
Answer: Implementing automatic logoff for workstations after a period of inactivity
Automatic logoff is a technical safeguard that terminates an electronic session after a predetermined period of inactivity to prevent unauthorized access.
A covered entity that experiences a breach affecting more than 500 residents of a state must notify the media within:
Answer: 60 days of discovery
For breaches affecting more than 500 residents of a state or jurisdiction, covered entities must notify prominent media outlets in addition to individuals, within 60 days of discovery.
Which of the following best describes the concept of 'Integrity' in the context of the HIPAA Security Rule?
Answer: Ensuring ePHI is not altered or destroyed in an unauthorized manner
Under HIPAA's Security Rule, integrity means that ePHI is not altered or destroyed in an unauthorized manner, preserving its accuracy and completeness.