Certified Information Privacy Professional HIPAA Privacy Requirements 2

Question 1

Which de-identification method under HIPAA requires a statistician to certify that risk of identification is very small?

Accepted Answer

Expert determination method

Answer

The expert determination method requires a qualified statistician to certify that the risk of identifying individuals is very small using generally accepted principles.

Question 2

What is a 'limited data set' under HIPAA?

Accepted Answer

PHI with most direct identifiers removed, used for research, public health, or healthcare operations under a data use agreement

Answer

A limited data set has direct identifiers like names and SSNs removed but may still include dates and geographic data at the zip code level or above, shared via data use agreement.

Question 3

Under HIPAA, what is required when a covered entity engages a business associate to perform functions involving PHI?

Accepted Answer

A Business Associate Agreement (BAA) must be in place

Answer

Covered entities must have a Business Associate Agreement with each business associate, establishing PHI use and protection obligations.

Question 4

Which HIPAA right allows a patient to request that a covered entity not disclose their PHI to their health plan for services paid out-of-pocket?

Accepted Answer

Right to request restrictions on disclosures to health plans

Answer

HIPAA requires covered entities to honor a patient's request to restrict disclosure to a health plan when the patient pays out-of-pocket in full for a service.

Question 5

What is the HIPAA Privacy Rule's general rule on the use of PHI for marketing?

Accepted Answer

PHI cannot be used for marketing without written patient authorization

Answer

The HIPAA Privacy Rule requires covered entities to obtain prior written authorization before using PHI for most marketing communications.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional HIPAA Privacy Requirements 2