CEHRS Information Management and Privacy 5

Question 1

Which document establishes the legal relationship between a covered entity and a vendor that handles PHI on its behalf?

Accepted Answer

Business Associate Agreement (BAA)

Answer

A Business Associate Agreement contractually requires the vendor to protect PHI and comply with HIPAA obligations on behalf of the covered entity.

Question 2

A limited data set under HIPAA may be used for research, public health, or health care operations. What must be removed from a limited data set?

Accepted Answer

Direct identifiers such as names, addresses, and social security numbers

Answer

A limited data set removes direct identifiers like names, SSNs, and addresses, but may retain dates and geographic data at levels larger than a street address.

Question 3

Which HIPAA civil monetary penalty tier applies when a covered entity did not know and could not reasonably have known about the violation?

Accepted Answer

$100–$50,000 per violation (Tier 1 — unknowing)

Answer

Tier 1 penalties of $100 to $50,000 per violation apply when the entity was unaware of the violation and exercised reasonable diligence.

Question 4

A researcher wants to access an EHR database without patient authorization for a study on diabetes outcomes. Under HIPAA, which option allows this?

Accepted Answer

De-identified data under the Safe Harbor or Expert Determination method

Answer

Using properly de-identified data via Safe Harbor or Expert Determination removes HIPAA protections, allowing research without patient authorization or a DUA.

Question 5

A patient who is a minor requests access to their own reproductive health records, which they paid for privately. The parent also requests the same records. What should the EHR specialist do?

Accepted Answer

Follow state law, which may grant the minor control over these records

Answer

HIPAA defers to state law on minors' rights; many states grant minors the right to control records for services they can consent to independently, such as reproductive health.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS Information Management and Privacy 5