CCS Security Principles and Practices 2

Question 1

Under HIPAA, which of the following is NOT considered protected health information (PHI)?

Accepted Answer

De-identified patient data with all 18 identifiers removed

Answer

Data that has had all 18 HIPAA identifiers removed through proper de-identification is no longer considered PHI.

Question 2

A coding specialist receives a request for medical records from a patient's employer. Under HIPAA, the coder should:

Accepted Answer

Require a valid patient authorization before releasing any records

Answer

Employers are not covered entities, so a valid signed patient authorization is required before releasing PHI to them.

Question 3

Which security measure ensures that electronic PHI has not been altered or destroyed in an unauthorized manner?

Accepted Answer

Integrity control

Answer

Integrity controls protect ePHI from unauthorized alteration or destruction, ensuring data accuracy and completeness.

Question 4

A hospital's coding department stores patient files on shared drives. Which access control approach best aligns with the minimum necessary standard?

Accepted Answer

Access is limited to only the data needed to perform each job function

Answer

The minimum necessary standard requires limiting access to only the PHI needed for each employee to perform their specific job duties.

Question 5

What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

Accepted Answer

To ensure vendors who handle PHI comply with HIPAA privacy and security rules

Answer

A BAA is a contract requiring business associates who access PHI on behalf of a covered entity to safeguard that information per HIPAA requirements.

(CCS) Certified Coding Specialist Practice Test