CHISSP CHISSP HIPAA Compliance & Healthcare Data Privacy

Question 1

Under HIPAA, which category of organizations is directly regulated as a 'covered entity'?

Accepted Answer

Healthcare providers, health plans, and healthcare clearinghouses

Answer

Medical device manufacturers and pharmaceutical companies

Answer

Health IT vendors and EHR software developers

Answer

Employers who sponsor self-insured health plans exclusively

Question 2

How many of the 18 HIPAA-defined identifiers must be removed from patient data for it to qualify as 'de-identified' under the Safe Harbor method?

Accepted Answer

All 18 identifiers must be removed

Answer

At least 15 of the 18 identifiers

Answer

Only the 5 most identifying elements

Answer

Name, DOB, SSN, and address are sufficient

Question 3

What is the maximum penalty per violation category per year under the HIPAA tiered civil monetary penalty structure (post-HITECH)?

Accepted Answer

$1,919,173 (adjusted annually for inflation)

Answer

$250,000

Answer

$1,000,000

Answer

$10,000,000

Question 4

A healthcare provider wants to share patient records with a public health authority for disease surveillance without patient authorization. Is this permissible under HIPAA?

Accepted Answer

Yes, public health activities are a permitted disclosure without patient authorization

Answer

No, all disclosures require explicit written patient authorization

Answer

Yes, but only if the patient is deceased

Answer

No, unless the provider obtains a court order first

Question 5

Which HIPAA rule specifically establishes the requirements for electronic transactions and code sets used in healthcare billing?

Accepted Answer

HIPAA Transactions and Code Sets Rule

Answer

HIPAA Privacy Rule

Answer

HIPAA Security Rule

Answer

HIPAA Breach Notification Rule

Question 6

Under HIPAA's Minimum Necessary standard, when must a covered entity apply this requirement?

Accepted Answer

When using or disclosing PHI for any purpose other than treatment

Answer

For all disclosures including those for treatment purposes between providers

Answer

Only when disclosing PHI to business associates

Answer

Only for disclosures to law enforcement