CHAA - Certified Healthcare Access Associate HIPAA Privacy and Security 2

Question 1

Which of the following is an example of a HIPAA-permitted disclosure of PHI without patient authorization?

Accepted Answer

Disclosing PHI to public health authorities to prevent disease spread

Answer

HIPAA permits disclosure of PHI without patient authorization for specific public interest purposes, including public health activities such as disease surveillance and prevention. Marketing, employer use outside treatment, and unauthorized third-party requests do not qualify.

Question 2

What is the minimum necessary standard under HIPAA?

Accepted Answer

Covered entities must share the least amount of PHI needed to accomplish the intended purpose

Answer

The minimum necessary standard requires that covered entities make reasonable efforts to limit the use, disclosure, and requests for PHI to the minimum amount needed to accomplish the intended purpose, reducing unnecessary exposure of patient information.

Question 3

Under HIPAA, a Business Associate Agreement (BAA) is required when:

Accepted Answer

A covered entity shares PHI with a vendor who performs services on its behalf

Answer

A BAA is a written contract required between a covered entity and a business associate — any third-party vendor or contractor that creates, receives, maintains, or transmits PHI while performing services for the covered entity. Internal staff and patient requests do not require a BAA.

Question 4

Which of the following best describes a 'covered entity' under HIPAA?

Accepted Answer

A health plan, healthcare clearinghouse, or healthcare provider that transmits PHI electronically

Answer

HIPAA defines covered entities as health plans, healthcare clearinghouses, and healthcare providers that transmit any health information electronically in connection with a covered transaction. General businesses and employers are not automatically covered entities.

Question 5

Which of the following is a required safeguard under the HIPAA Security Rule's physical safeguard standards?

Accepted Answer

Controlling facility access to systems containing electronic PHI

Answer

Physical safeguards under the HIPAA Security Rule include measures to control physical access to facilities and workstations where ePHI is stored or processed. Encryption and phishing training fall under technical and administrative safeguards, respectively.

CHAA - Certified Healthcare Access Associate Practice Test

CHAA - Certified Healthcare Access Associate Practice Test

CHAA - Certified Healthcare Access Associate HIPAA Privacy and Security 2