CEC Privacy and Security Standards 2

Question 1

Under HIPAA, which of the following is considered Protected Health Information (PHI)?

Accepted Answer

A patient's diagnosis combined with their name

Answer

An employee's work schedule

Answer

A hospital's annual revenue report

Answer

A generic health tip published in a newsletter

Question 2

A Marketplace Navigator receives a paper application containing an applicant's SSN. What is the most appropriate way to store this document?

Accepted Answer

Store it in a locked cabinet with restricted access

Answer

Leave it on the desk for easy access

Answer

Scan it and email it to a colleague

Answer

File it alphabetically in an open office drawer

Question 3

Which federal law primarily governs the privacy of student education records and is relevant when assisting student-aged applicants?

Accepted Answer

FERPA

Answer

HIPAA

Answer

COPPA

Answer

ACA Section 1557

Question 4

An enrollment counselor accidentally sends an applicant's eligibility information to the wrong email address. This is an example of a:

Accepted Answer

Unauthorized disclosure requiring notification

Answer

Permitted disclosure

Answer

Business associate breach

Answer

De-identified data release

Question 5

What does 'minimum necessary' mean in the context of HIPAA privacy rules for enrollment counselors?

Accepted Answer

Access or share only the amount of PHI needed to complete the task

Answer

Only collect data required at the minimum income threshold

Answer

Provide the minimum number of plan options to applicants

Answer

Enroll only the minimum required number of applicants per month

Question 6

Which of the following is a 'safe harbor' de-identification method under HIPAA?

Accepted Answer

Removing all 18 specific identifiers defined by HIPAA

Answer

Encrypting all 18 identifiers with a password

Answer

Replacing names with pseudonyms

Answer

Storing records in a separate secure database

Question 7

When an applicant asks who has access to their enrollment application data, the enrollment counselor should:

Accepted Answer

Explain the privacy notice and describe authorized data access

Answer

Decline to answer to protect security protocols

Answer

Refer them only to the federal government website

Answer

Tell them only the Navigator has access