CCT HIPAA Privacy and Security 3

Question 1

A hospital's employee inappropriately accesses the medical records of a celebrity patient. Which type of HIPAA breach is this?

Accepted Answer

Unauthorized internal access

Answer

Accessing PHI without a valid treatment, payment, or operations reason by an insider constitutes unauthorized internal access, a common HIPAA violation.

Question 2

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach within:

Accepted Answer

60 calendar days

Answer

The Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and within 60 calendar days of discovering the breach.

Question 3

What is 'minimum necessary' under HIPAA?

Accepted Answer

Disclosing only the PHI needed to accomplish the intended purpose

Answer

The minimum necessary standard requires covered entities to limit PHI use and disclosure to what is needed for the specific purpose.

Question 4

Which of the following is a permitted use of PHI WITHOUT patient authorization under HIPAA?

Accepted Answer

Public health activities to control disease

Answer

HIPAA permits disclosure of PHI for public health activities, such as reporting disease outbreaks, without patient authorization.

Question 5

A covered entity discovers a breach on March 1. By what date must it notify the Secretary of HHS if fewer than 500 individuals are affected?

Accepted Answer

Within 60 days of the following calendar year (by March 1 of the next year)

Answer

For breaches affecting fewer than 500 individuals, covered entities must log and report to HHS annually, no later than 60 days after the end of the calendar year in which the breach occurred.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT HIPAA Privacy and Security 3