CHAA HIPAA Privacy and Security Flashcards
7 cards from real CHAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 CHAA HIPAA Privacy and Security flashcards as text
A patient requests a copy of their medical record. Under HIPAA, within what time frame must the covered entity generally act on the request?
Answer: 30 days, with one possible 30-day extension
Covered entities must act within 30 days of an access request and may extend once by up to 30 days with written notice.
Which of the following is a business associate that requires a Business Associate Agreement with the hospital?
Answer: An outside medical transcription company
An outside vendor that creates or handles PHI on the covered entity's behalf is a business associate.
A waiting-room patient overhears another patient's name called out despite the facility's reasonable safeguards. How is this classified under HIPAA?
Answer: A permitted incidental use or disclosure
Incidental disclosures are permitted when reasonable safeguards and minimum necessary practices are in place.
Which type of health information almost always requires a specific patient authorization before disclosure, even for treatment or payment?
Answer: Psychotherapy notes
Psychotherapy notes kept separate from the medical record receive special protection and generally require specific authorization.
Under HIPAA, who is generally recognized as the personal representative of an unemancipated minor?
Answer: A parent or legal guardian
Parents or guardians with authority to make health care decisions are generally treated as the minor's personal representative, with some state-law exceptions.
A laptop containing PHI encrypted to HHS guidance standards is stolen. What is the breach notification obligation?
Answer: No breach notification is required because the PHI is secured
Properly encrypted PHI counts as secured, so the Breach Notification Rule's safe harbor applies.
Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?
Answer: HHS Office for Civil Rights
The HHS Office for Civil Rights (OCR) enforces the Privacy and Security Rules, while the DOJ handles criminal cases.
How this page was made: written with AI tools. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy
Sources & references
Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy
- naham.org — Eligibility, exam format, passing score, time limit, score validity, test delivery, fees, registration, retake fee, score release · verified Oct 2026