CHC HIPAA Privacy and Security 2

Question 1

Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Accepted Answer

De-identified health data that meets Safe Harbor standards

Answer

De-identified data that meets HIPAA's Safe Harbor or Expert Determination standards is not PHI and is not subject to HIPAA protections.

Question 2

A covered entity experiences a breach affecting 600 individuals. What is the notification deadline to the Secretary of HHS?

Accepted Answer

Within 60 days of discovery

Answer

Breaches affecting 500 or more individuals must be reported to HHS within 60 days of discovery.

Question 3

What is the HIPAA Security Rule's requirement for a covered entity's risk analysis?

Accepted Answer

It must be an accurate and thorough assessment of risks to ePHI

Answer

The Security Rule requires covered entities to conduct an accurate and thorough assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability.

Question 4

Under the HIPAA Privacy Rule, a patient's right to request restrictions on use or disclosure of their PHI means the covered entity:

Accepted Answer

Must honor requests to restrict disclosures to health plans for services paid out-of-pocket in full

Answer

Covered entities must agree to a patient's request to restrict disclosures to health plans when the patient pays for the service entirely out-of-pocket.

Question 5

Which HIPAA Security Rule safeguard category includes policies and procedures to manage the selection and use of technical security measures?

Accepted Answer

Administrative safeguards

Answer

Administrative safeguards include policies and procedures that govern the selection and use of technical and physical security measures to protect ePHI.

CHC - Certified in Healthcare Compliance Practice Test

CHC - Certified in Healthcare Compliance Practice Test

CHC HIPAA Privacy and Security 2