Certified Information Privacy Professional HIPAA Privacy Requirements

Question 1

Which of the following is NOT a permitted use or disclosure of PHI under the HIPAA Privacy Rule without patient authorization?

Accepted Answer

Marketing campaigns selling health products

Answer

Treatment of the patient

Answer

Payment for health services

Answer

Healthcare operations like quality improvement

Question 2

What is the HIPAA 'minimum necessary' standard?

Accepted Answer

Covered entities must make reasonable efforts to use only the minimum PHI necessary for the intended purpose

Answer

Patients can only access the minimum amount of their own records

Answer

Only the minimum number of employees may handle PHI

Answer

Business associates must delete PHI within a minimum timeframe

Question 3

Under HIPAA, patients have the right to access their PHI within how many days of requesting it?

Accepted Answer

30 days, extendable once by 30 additional days

Answer

7 days

Answer

60 days with no extension

Answer

90 days with one 30-day extension

Question 4

Which type of entity is directly covered by HIPAA's Privacy Rule?

Accepted Answer

Covered entities (health plans, providers, clearinghouses)

Answer

Any company that collects health data

Answer

All employers who maintain employee health records

Answer

All software companies handling health data

Question 5

What does a HIPAA Notice of Privacy Practices (NPP) require?

Accepted Answer

A description of how the covered entity uses and discloses PHI and patients' rights

Answer

A complete list of every employee with PHI access

Answer

A financial statement of PHI processing costs

Answer

Proof that all PHI is encrypted

Question 6

Under HIPAA, a covered entity must provide an individual an accounting of disclosures of their PHI for a period of up to how many years?

Accepted Answer

6 years prior to the date of the request

Answer

3 years prior to the date of the request

Answer

1 year prior to the date of the request

Answer

10 years prior to the date of the request