Certified Information Privacy Professional HIPAA Privacy Requirements

Question 1

Which of the following is NOT a permitted use or disclosure of PHI under the HIPAA Privacy Rule without patient authorization?

Accepted Answer

Marketing campaigns selling health products

Answer

Marketing activities that use PHI to encourage purchase of products require patient authorization; treatment, payment, and healthcare operations are permitted without it.

Question 2

What is the HIPAA 'minimum necessary' standard?

Accepted Answer

Covered entities must make reasonable efforts to use only the minimum PHI necessary for the intended purpose

Answer

The minimum necessary standard requires covered entities to limit PHI use and disclosure to the least amount needed to accomplish the intended purpose.

Question 3

Under HIPAA, patients have the right to access their PHI within how many days of requesting it?

Accepted Answer

30 days, extendable once by 30 additional days

Answer

Covered entities must provide access to PHI within 30 days, with the ability to extend once by an additional 30 days with written explanation.

Question 4

Which type of entity is directly covered by HIPAA's Privacy Rule?

Accepted Answer

Covered entities (health plans, providers, clearinghouses)

Answer

HIPAA directly covers 'covered entities': health plans, healthcare providers that transmit PHI electronically, and healthcare clearinghouses.

Question 5

What does a HIPAA Notice of Privacy Practices (NPP) require?

Accepted Answer

A description of how the covered entity uses and discloses PHI and patients' rights

Answer

The NPP must inform patients how their PHI may be used and disclosed, their privacy rights, and the covered entity's legal duties regarding PHI.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional HIPAA Privacy Requirements