CCT - Certified Compliance Technician HIPAA Privacy and Security Questions and Answers

Question 1

A hospital's billing department is preparing to send a patient's invoice to a third-party collection agency.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following Protected Health Information (PHI) is most appropriate for the hospital to disclose?

Accepted Answer

Patient's name, address, dates of service, and the total outstanding balance.

Answer

Patient's entire medical record, including treatment history and physician's notes.

Answer

Patient's name, Social Security Number, and primary diagnosis code.

Answer

Patient's name, insurance policy number, and the name of their primary care physician.

Question 2

A small medical clinic is implementing its HIPAA Security Rule compliance plan. When addressing the implementation specifications for its administrative safeguards, what is the key difference between 'required' and 'addressable' specifications?

Accepted Answer

Addressable specifications must be assessed; if not implemented, the decision and rationale must be documented.

Answer

Required specifications must be implemented exactly as stated, while addressable specifications are optional.

Answer

Required specifications apply only to large healthcare systems, while addressable ones apply to small clinics.

Answer

Addressable specifications are technical in nature, while required specifications are purely administrative policies.

Question 3

A business associate discovers a breach of unsecured PHI affecting 450 individuals of a covered entity on March 1st. What is the latest date by which the business associate must notify the covered entity?

Accepted Answer

Without unreasonable delay, and in no case later than 60 days following discovery.

Answer

Within 24 hours of discovery.

Answer

Within 60 days of the end of the calendar year.

Answer

Immediately, as all breaches require instant notification to the covered entity.

Question 4

Which of the following is an example of a HIPAA Security Rule 'technical safeguard'?

Accepted Answer

Using encryption to render electronic protected health information (ePHI) unreadable.

Answer

Developing a security incident response plan.

Answer

Positioning computer monitors to prevent public viewing of ePHI.

Answer

Implementing a security awareness and training program for the workforce.

Question 5

A patient submits a written request to their healthcare provider for a copy of their medical records. Under the HIPAA Privacy Rule, the provider must generally provide access to the records within what timeframe?

Accepted Answer

30 calendar days

Answer

10 business days

Answer

60 calendar days

Answer

Immediately upon request

Question 6

A hospital experiences a data breach of unsecured PHI that affects 600 residents of a single state. In addition to notifying the affected individuals and the Secretary of HHS, what other notification is required by the HIPAA Breach Notification Rule?

Accepted Answer

Notifying prominent media outlets serving the state or jurisdiction.

Answer

Notifying the local police department.

Answer

Purchasing credit monitoring services for all affected individuals.

Answer

Reporting the breach to the Federal Trade Commission (FTC).

A hospital's billing department is preparing to send a patient's invoice to a third-party collection agency.According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following Protected Health Information (PHI) is most appropriate for the hospital to disclose?

A hospital's billing department is preparing to send a patient's invoice to a third-party collection agency.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following Protected Health Information (PHI) is most appropriate for the hospital to disclose?