CHAA - Certified Healthcare Access Associate HIPAA Privacy and Security 8

Question 1

Which of the following is NOT one of the three safeguard categories required by the HIPAA Security Rule?

Accepted Answer

Financial safeguards

Answer

The HIPAA Security Rule requires covered entities to implement three categories of safeguards: administrative, physical, and technical. Financial safeguards are not a recognized category under the Security Rule.

Question 2

Under HIPAA, a 'covered entity' includes which of the following?

Accepted Answer

A health plan that pays for medical services

Answer

Covered entities under HIPAA include health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically. Employers, law firms without health data, and unrelated service vendors are generally not covered entities.

Question 3

What is the maximum period a patient generally has to request their own medical records from a covered entity under the HIPAA Privacy Rule?

Accepted Answer

60 days

Answer

The HIPAA Privacy Rule requires covered entities to provide access to a patient's records within 30 days, with a possible 30-day extension if needed, making the outer limit 60 days. Patients do not have to wait 90 days.

Question 4

Which HIPAA concept allows a covered entity to share PHI for treatment, payment, and healthcare operations WITHOUT obtaining the patient's written authorization?

Accepted Answer

Permitted disclosure

Answer

HIPAA allows 'permitted disclosures' — sharing PHI for treatment, payment, and healthcare operations (TPO) without written patient authorization. This is distinct from voluntary disclosures that do require authorization.

Question 5

A hospital employee accesses the medical record of a celebrity patient out of curiosity, even though they are not involved in that patient's care. This is a violation of which HIPAA principle?

Accepted Answer

The minimum necessary standard

Answer

The minimum necessary standard requires employees to access only the PHI needed to perform their job duties. Accessing records out of curiosity — with no treatment, payment, or operations purpose — violates this core HIPAA principle.

CHAA - Certified Healthcare Access Associate Practice Test

CHAA - Certified Healthcare Access Associate Practice Test

CHAA - Certified Healthcare Access Associate HIPAA Privacy and Security 8