CCS Security Principles and Practices 2 — Questions and Answers
Question 1: Under HIPAA, which of the following is NOT considered protected health information (PHI)?
- Patient diagnosis stored in an EHR
- De-identified patient data with all 18 identifiers removed (Correct answer)
- Patient name linked to a prescription
- Patient address included in a lab report
Correct answer: De-identified patient data with all 18 identifiers removed
Data that has had all 18 HIPAA identifiers removed through proper de-identification is no longer considered PHI.
Question 2: A coding specialist receives a request for medical records from a patient's employer. Under HIPAA, the coder should:
- Release the records because employers pay for insurance
- Release only employment-related records
- Require a valid patient authorization before releasing any records (Correct answer)
- Deny the request and notify law enforcement
Correct answer: Require a valid patient authorization before releasing any records
Employers are not covered entities, so a valid signed patient authorization is required before releasing PHI to them.
Question 3: Which security measure ensures that electronic PHI has not been altered or destroyed in an unauthorized manner?
- Confidentiality control
- Integrity control (Correct answer)
- Availability control
- Authentication control
Correct answer: Integrity control
Integrity controls protect ePHI from unauthorized alteration or destruction, ensuring data accuracy and completeness.
Question 4: A hospital's coding department stores patient files on shared drives. Which access control approach best aligns with the minimum necessary standard?
- All staff have full read/write access to all patient files
- Access is limited to only the data needed to perform each job function (Correct answer)
- Administrative staff control all access permissions personally
- Physicians have unrestricted access, coders have none
Correct answer: Access is limited to only the data needed to perform each job function
The minimum necessary standard requires limiting access to only the PHI needed for each employee to perform their specific job duties.
Question 5: What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?
- To authorize billing for covered services
- To ensure vendors who handle PHI comply with HIPAA privacy and security rules (Correct answer)
- To establish payment terms between providers and insurers
- To document employee training completion
Correct answer: To ensure vendors who handle PHI comply with HIPAA privacy and security rules
A BAA is a contract requiring business associates who access PHI on behalf of a covered entity to safeguard that information per HIPAA requirements.
Question 6: An audit log in a health information system primarily serves which security purpose?
- Encrypting data during transmission
- Tracking and reviewing who accessed or modified patient records (Correct answer)
- Blocking unauthorized users from logging in
- Automatically backing up patient data
Correct answer: Tracking and reviewing who accessed or modified patient records
Audit logs record access and changes to ePHI, enabling detection of unauthorized or suspicious activity in health information systems.
Question 7: When a covered entity discovers a breach of unsecured PHI affecting 600 patients, HIPAA requires notification to:
- The FBI and local police only
- Affected individuals, HHS, and prominent local media outlets (Correct answer)
- Only the patients affected, within 30 days
- Only HHS, within 60 days
Correct answer: Affected individuals, HHS, and prominent local media outlets
For breaches affecting 500 or more individuals in a state, HIPAA requires notifying affected individuals, HHS, and prominent media in that state.
CCS Security Principles and Practices 2
Under HIPAA, which of the following is NOT considered protected health information (PHI)?