CCT HIPAA Privacy and Security 5

Question 1

What is a 'hybrid entity' under HIPAA?

Accepted Answer

A single legal entity that performs both covered and non-covered functions, and has designated its healthcare components

Answer

A hybrid entity is a single organization that performs both covered and non-covered functions, and HIPAA applies only to its designated healthcare component(s).

Question 2

Under the HIPAA Security Rule, which of the following is a 'required' (not addressable) implementation specification?

Accepted Answer

Unique user identification for each system user

Answer

Unique user identification is a required implementation specification under the Access Control standard of the HIPAA Security Rule's Technical Safeguards.

Question 3

If a business associate discovers a breach of PHI, they must notify the covered entity within:

Accepted Answer

Without unreasonable delay and no later than 60 calendar days of discovery

Answer

Business associates must notify covered entities of PHI breaches without unreasonable delay and within 60 calendar days of discovering the breach.

Question 4

Which of the following scenarios qualifies as a HIPAA-compliant 'de-identification' method?

Accepted Answer

Removing all 18 specific identifiers listed in the Safe Harbor method

Answer

The Safe Harbor method requires removal of all 18 enumerated identifiers, after which the data is no longer considered PHI under HIPAA.

Question 5

A covered entity may share PHI with a patient's family member without authorization when:

Accepted Answer

The patient is present and does not object, or the covered entity can infer from the circumstances that the patient would not object

Answer

When a patient is present and does not object, or when a provider infers non-objection from circumstances, PHI directly relevant to the family member's involvement in care may be shared.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT HIPAA Privacy and Security 5