CEHRS Information Management and Privacy 3

Question 1

A breach of unsecured PHI affecting 600 patients requires notification to which entities under the HIPAA Breach Notification Rule?

Accepted Answer

Affected individuals, HHS, and prominent local media outlets

Answer

Breaches affecting 500 or more individuals in a state require notification to affected individuals, HHS, and prominent media outlets in that state.

Question 2

Which factor is NOT part of the four-factor risk assessment used to determine if a breach of PHI requires notification?

Accepted Answer

The financial cost of the breach investigation

Answer

The HIPAA breach risk assessment evaluates the type of PHI, who accessed it, whether it was actually acquired or viewed, and the extent of mitigation — not investigation costs.

Question 3

Under HITECH, business associates are directly liable for HIPAA compliance. Which of the following is a business associate?

Accepted Answer

A billing company that processes claims containing PHI

Answer

A billing company that handles PHI on behalf of a covered entity is a business associate and must sign a Business Associate Agreement.

Question 4

Which encryption standard is most commonly referenced as making PHI 'unusable, unreadable, or indecipherable' under the HIPAA Safe Harbor method?

Accepted Answer

NIST-validated encryption processes

Answer

HHS guidance specifies that PHI encrypted using NIST-validated cryptographic algorithms qualifies for the breach notification Safe Harbor.

Question 5

A patient's psychotherapy notes are held to a stricter standard than general medical records under HIPAA because they:

Accepted Answer

Are always stored separately and require specific authorization for most disclosures

Answer

Psychotherapy notes are specifically protected under HIPAA and generally require patient authorization for disclosure even for TPO purposes, unlike most other PHI.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS Information Management and Privacy 3