CEHRS Information Management and Privacy 2

Question 1

Under HIPAA, a covered entity must respond to a patient's request to access their PHI within how many days?

Accepted Answer

60 days

Answer

HIPAA requires covered entities to act on a patient's access request within 30 days, with a possible 30-day extension (60 days total).

Question 2

Which type of EHR audit log entry would BEST identify unauthorized access to a patient record?

Accepted Answer

A log showing which user accessed the record and at what time

Answer

Audit logs that capture user identity, record accessed, and timestamp are the primary tool for detecting and investigating unauthorized access.

Question 3

A patient calls asking for their lab results to be faxed directly to their employer. What should the EHR specialist do?

Accepted Answer

Obtain a valid written authorization from the patient before releasing

Answer

Releasing PHI to an employer requires a valid patient authorization because employers are not covered entities and this disclosure exceeds standard TPO purposes.

Question 4

Which HIPAA Privacy Rule provision allows a patient to request that a specific disclosure of their PHI not be made to their health plan?

Accepted Answer

Right to request restrictions

Answer

The right to request restrictions permits patients to ask covered entities to limit certain uses or disclosures, including to health plans when the patient pays out-of-pocket in full.

Question 5

An EHR system automatically generates a summary of a patient's visit and sends it to a referring physician. This is an example of PHI disclosure for which purpose?

Accepted Answer

Treatment

Answer

Sharing clinical information with a referring physician to coordinate care is a treatment-related disclosure, which does not require patient authorization.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS Information Management and Privacy 2