CHC HIPAA Privacy and Security 3 — Questions and Answers
Question 1: Under the HIPAA Privacy Rule, the 'minimum necessary' standard does NOT apply to which type of disclosure?
- Disclosures to health oversight agencies
- Disclosures for treatment purposes to healthcare providers (Correct answer)
- Disclosures to business associates
- Disclosures for research purposes
Correct answer: Disclosures for treatment purposes to healthcare providers
The minimum necessary standard does not apply to disclosures made to or requests by a healthcare provider for treatment purposes.
Question 2: A covered entity may use or disclose PHI without patient authorization for which of the following purposes?
- Marketing a third-party product using the patient's purchase history
- Disclosing to an employer for employment decisions
- Reporting a gunshot wound to law enforcement as required by state law (Correct answer)
- Selling PHI to a data analytics company
Correct answer: Reporting a gunshot wound to law enforcement as required by state law
HIPAA permits disclosure to law enforcement when required by law, such as mandatory reporting of gunshot wounds.
Question 3: What is the maximum civil monetary penalty per violation category for violations where the covered entity did not know and could not have known of the violation?
- $100 per violation, up to $25,000 per year (Correct answer)
- $1,000 per violation, up to $100,000 per year
- $10,000 per violation, up to $250,000 per year
- $50,000 per violation, up to $1.5 million per year
Correct answer: $100 per violation, up to $25,000 per year
The lowest tier of civil monetary penalties applies to unknowing violations at $100–$50,000 per violation, up to $25,000 per identical violation per year.
Question 4: Under HIPAA's Security Rule, which implementation specification is 'required' versus 'addressable' for the Workstation Use standard?
- Workstation Use is addressable; covered entities may choose alternatives
- Workstation Use is required; covered entities must implement it (Correct answer)
- Workstation Use specifications are all required with no flexibility
- Workstation Use has no implementation specifications
Correct answer: Workstation Use is required; covered entities must implement it
The Workstation Use standard under Physical Safeguards is required, meaning covered entities must implement policies governing proper workstation use.
Question 5: A patient requests an accounting of disclosures. Which type of disclosure must be included in the accounting?
- Disclosures for treatment, payment, and operations
- Disclosures made to the patient themselves
- Disclosures to public health authorities as required by law (Correct answer)
- Disclosures pursuant to a valid patient authorization
Correct answer: Disclosures to public health authorities as required by law
Disclosures required by law, such as those to public health authorities, must be included in the accounting of disclosures.
Question 6: Under the HIPAA Privacy Rule, a covered entity's Notice of Privacy Practices must be provided to patients:
- Only upon the patient's written request
- No later than the date of first service delivery (Correct answer)
- Annually for all current patients
- Only when the notice is materially revised
Correct answer: No later than the date of first service delivery
Covered entities must provide the Notice of Privacy Practices no later than the date of first service delivery to the individual.
Question 7: Which of the following entities is DIRECTLY covered under HIPAA as a covered entity?
- A cloud storage vendor storing ePHI for a hospital
- A law firm advising a health plan on compliance matters
- A health insurance company that processes claims electronically (Correct answer)
- A janitorial company cleaning a medical office
Correct answer: A health insurance company that processes claims electronically
Health plans that process standard electronic transactions are covered entities directly subject to HIPAA regulations.
CHC HIPAA Privacy and Security 3
Under the HIPAA Privacy Rule, the 'minimum necessary' standard does NOT apply to which type of disclosure?