CEHRS - Certified Electronic Health Records Specialist HIPAA and Patient Confidentiality Questions and Answers

Question 1

A CEHRS is working at the registration desk when a patient's friend approaches and asks for an update on the patient's condition. The friend is not listed on any of the patient's authorization forms. Which of the following is the MOST appropriate response?

Accepted Answer

"I'm sorry, but due to privacy laws, I cannot confirm or deny whether that person is a patient here."

Answer

According to HIPAA, a covered entity cannot disclose any Protected Health Information (PHI) to individuals not authorized by the patient. Even confirming that someone is a patient is a disclosure of PHI. Therefore, the safest and most compliant response is to neither confirm nor deny the person's patient status.

Question 2

The HIPAA Security Rule requires covered entities to implement specific safeguards to protect electronic protected health information (ePHI). Which of the following is an example of an administrative safeguard?

Accepted Answer

Implementing policies for sanctioning employees who violate HIPAA.

Answer

Administrative safeguards are defined as 'administrative actions, and policies and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect ePHI...' A sanction policy is a required administrative action. Encrypted software is a technical safeguard, monitor positioning is a physical safeguard, and key card access is a physical safeguard.

Question 3

A CEHRS receives a request from the billing department for a patient's entire medical record to verify a single service date. Which HIPAA principle should guide the CEHRS's response?

Accepted Answer

Minimum Necessary Standard

Answer

The Minimum Necessary Standard requires covered entities to make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose. Releasing the entire record when only a service date is needed would violate this principle. The CEHRS should provide only the specific information required.

Question 4

During a busy clinic session, a CEHRS accidentally hands a patient a visit summary belonging to another patient. The patient returns the document immediately. What is the CEHRS's first and most critical action?

Accepted Answer

Report the incident to the designated Privacy Officer.

Answer

Any accidental disclosure of PHI, even if seemingly minor, must be reported internally to the designated Privacy or Security Officer. The Privacy Officer is responsible for investigating the incident, performing a risk assessment to determine if it constitutes a reportable breach, and documenting the event according to facility policy and HIPAA regulations.

Question 5

Which of the following is a primary purpose of the Notice of Privacy Practices (NPP) given to patients?

Accepted Answer

To inform patients of their privacy rights and how their PHI may be used.

Answer

The HIPAA Privacy Rule requires covered entities to provide patients with a Notice of Privacy Practices (NPP). This document's purpose is to detail how their Protected Health Information (PHI) may be used and disclosed for treatment, payment, and operations, and to inform them of their legal rights regarding their PHI, such as the right to access their records.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS - Certified Electronic Health Records Specialist HIPAA and Patient Confidentiality Questions and Answers