CCT HIPAA Privacy and Security 2

Question 1

Under HIPAA, which of the following is an example of a 'limited data set'?

Accepted Answer

Dates of service and geographic data below state level with no direct identifiers

Answer

Patient name and SSN with diagnosis

Answer

Full address and phone number

Answer

All 18 identifiers with a data use agreement

Question 2

Which HIPAA rule requires covered entities to implement policies protecting electronic protected health information (ePHI)?

Accepted Answer

Security Rule

Answer

Privacy Rule

Answer

Breach Notification Rule

Answer

Enforcement Rule

Question 3

A patient requests access to their medical records. Under HIPAA, the covered entity must provide access within how many days?

Accepted Answer

30 days

Answer

10 days

Answer

60 days

Answer

90 days

Question 4

What is the maximum civil monetary penalty per violation category under HIPAA for 'reasonable cause' (not willful neglect)?

Accepted Answer

$10,000

Answer

$1,000

Answer

$100,000

Answer

$250,000

Question 5

Which of the following is NOT a required element of a valid HIPAA authorization?

Accepted Answer

Signature of the covered entity's Privacy Officer

Answer

Description of PHI to be used or disclosed

Answer

Expiration date or event

Answer

Statement that the individual may revoke the authorization

Question 6

Under the HIPAA Security Rule, an 'addressable' implementation specification means:

Accepted Answer

The covered entity must assess whether it is reasonable and appropriate, and document the decision

Answer

It must be implemented exactly as written

Answer

It is optional and may be skipped

Answer

It applies only to large covered entities

Question 7

Which entity type is primarily responsible for signing a Business Associate Agreement (BAA) with a covered entity?

Accepted Answer

An organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity

Answer

Any vendor providing office supplies

Answer

State health departments only

Answer

Employees of the covered entity