CEHRS HIPAA and Patient Confidentiality 5

Question 1

Under HIPAA, which of the following is a required (not addressable) implementation specification under the Security Rule?

Accepted Answer

Unique user identification

Answer

Unique user identification is a required implementation specification, meaning it must be implemented; there is no flexibility to use an equivalent alternative.

Question 2

A covered entity experiences a breach affecting 600 individuals in one state. Under HIPAA's Breach Notification Rule, who must be notified?

Accepted Answer

Affected individuals and HHS only

Answer

Breaches affecting fewer than 500 individuals require notification to affected individuals and HHS (logged annually); media notification is only required for breaches affecting 500 or more in a state or jurisdiction.

Question 3

A hospital uses patient demographic and diagnosis data to analyze care quality and improve internal workflows. Under HIPAA, this activity falls under which permitted use?

Accepted Answer

Healthcare Operations

Answer

Quality assessment and improvement activities, as well as case management and care coordination reviews, fall under 'healthcare operations' as a permitted use of PHI.

Question 4

Which of the following statements about the HIPAA Privacy Rule and minors is CORRECT?

Accepted Answer

In some cases, minors may have the right to control their own PHI, such as when state law permits them to consent to certain care

Answer

When a minor is legally permitted to consent to their own care under state law (e.g., substance abuse, reproductive health), they may also control access to related PHI.

Question 5

An EHR specialist receives a subpoena for a patient's records. The covered entity should:

Accepted Answer

Notify the patient and wait for a qualified protective order before releasing records, unless other conditions are met

Answer

A subpoena alone is not sufficient authorization under HIPAA; the covered entity must either notify the patient or receive satisfactory assurance that a qualified protective order has been sought.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS HIPAA and Patient Confidentiality 5