CHPS Certified in Healthcare Privacy and Security 2

Question 1

Under HIPAA, which of the following is considered a 'hybrid entity'?

Accepted Answer

An organization that performs both covered and non-covered functions

Answer

A hybrid entity is an organization that performs both HIPAA-covered healthcare functions and non-covered functions and has designated its health care components accordingly.

Question 2

Which NIST framework publication provides guidance specifically for protecting health information in cybersecurity programs?

Accepted Answer

NIST SP 800-66

Answer

NIST SP 800-66 is the resource guide for implementing the HIPAA Security Rule and provides practical guidance for healthcare organizations.

Question 3

A patient requests an amendment to their medical record because they believe information is incorrect. Under HIPAA, the covered entity may deny the request if:

Accepted Answer

The record was not created by the covered entity

Answer

A covered entity may deny an amendment request if the PHI was not created by that entity, among other permissible reasons.

Question 4

What is the primary purpose of a Data Use Agreement (DUA) under HIPAA?

Accepted Answer

To permit use of a limited data set by a recipient for specific purposes

Answer

A DUA is required when a covered entity shares a limited data set (with most direct identifiers removed) with a recipient for research, public health, or health care operations.

Question 5

Under the HIPAA Breach Notification Rule, what is the maximum number of days a covered entity has to notify affected individuals of a breach?

Accepted Answer

60 days

Answer

Covered entities must notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days after discovery.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Certified in Healthcare Privacy and Security 2