CCT HIPAA Privacy and Security 2

Question 1

Under HIPAA, which of the following is an example of a 'limited data set'?

Accepted Answer

Dates of service and geographic data below state level with no direct identifiers

Answer

A limited data set excludes direct identifiers but may include dates and geographic subdivisions below state level, and requires a data use agreement.

Question 2

Which HIPAA rule requires covered entities to implement policies protecting electronic protected health information (ePHI)?

Accepted Answer

Security Rule

Answer

The HIPAA Security Rule specifically governs the protection of ePHI through administrative, physical, and technical safeguards.

Question 3

A patient requests access to their medical records. Under HIPAA, the covered entity must provide access within how many days?

Accepted Answer

30 days

Answer

HIPAA requires covered entities to act on a patient's request for access to their PHI within 30 days, with one 30-day extension allowed.

Question 4

What is the maximum civil monetary penalty per violation category under HIPAA for 'reasonable cause' (not willful neglect)?

Accepted Answer

$10,000

Answer

HIPAA penalties for 'reasonable cause' (not willful neglect) range up to $10,000 per violation, up to $100,000 per calendar year.

Question 5

Which of the following is NOT a required element of a valid HIPAA authorization?

Accepted Answer

Signature of the covered entity's Privacy Officer

Answer

A valid HIPAA authorization requires the individual's (not the Privacy Officer's) signature, along with description of PHI, expiration, and revocation rights.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT HIPAA Privacy and Security 2