CHISSP CHISSP HIPAA Compliance & Healthcare Data Privacy 1 — Questions and Answers
Question 1: Under HIPAA, which category of organizations is directly regulated as a 'covered entity'?
- Healthcare providers, health plans, and healthcare clearinghouses (Correct answer)
- Medical device manufacturers and pharmaceutical companies
- Health IT vendors and EHR software developers
- Employers who sponsor self-insured health plans exclusively
Correct answer: Healthcare providers, health plans, and healthcare clearinghouses
HIPAA's three categories of covered entities are healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses.
Question 2: How many of the 18 HIPAA-defined identifiers must be removed from patient data for it to qualify as 'de-identified' under the Safe Harbor method?
- All 18 identifiers must be removed (Correct answer)
- At least 15 of the 18 identifiers
- Only the 5 most identifying elements
- Name, DOB, SSN, and address are sufficient
Correct answer: All 18 identifiers must be removed
The Safe Harbor de-identification method under §164.514(b) requires removal of all 18 specified identifiers and verification that no residual information could identify the individual.
Question 3: What is the maximum penalty per violation category per year under the HIPAA tiered civil monetary penalty structure (post-HITECH)?
- $1,919,173 (adjusted annually for inflation) (Correct answer)
- $250,000
- $1,000,000
- $10,000,000
Correct answer: $1,919,173 (adjusted annually for inflation)
HITECH increased HIPAA civil penalties to a tiered structure with a maximum of $100 per violation up to $1.5 million per violation category per year, adjusted for inflation.
Question 4: A healthcare provider wants to share patient records with a public health authority for disease surveillance without patient authorization. Is this permissible under HIPAA?
- Yes, public health activities are a permitted disclosure without patient authorization (Correct answer)
- No, all disclosures require explicit written patient authorization
- Yes, but only if the patient is deceased
- No, unless the provider obtains a court order first
Correct answer: Yes, public health activities are a permitted disclosure without patient authorization
HIPAA §164.512(b) explicitly permits disclosures to public health authorities authorized to collect data for disease prevention and control without individual authorization.
Question 5: Which HIPAA rule specifically establishes the requirements for electronic transactions and code sets used in healthcare billing?
- HIPAA Transactions and Code Sets Rule (Correct answer)
- HIPAA Privacy Rule
- HIPAA Security Rule
- HIPAA Breach Notification Rule
Correct answer: HIPAA Transactions and Code Sets Rule
The HIPAA Transactions and Code Sets Rule mandates standard electronic formats (ASC X12) and code sets (ICD, CPT, HCPCS) for administrative transactions like claims and remittances.
Question 6: Under HIPAA's Minimum Necessary standard, when must a covered entity apply this requirement?
- When using or disclosing PHI for any purpose other than treatment (Correct answer)
- For all disclosures including those for treatment purposes between providers
- Only when disclosing PHI to business associates
- Only for disclosures to law enforcement
Correct answer: When using or disclosing PHI for any purpose other than treatment
The Minimum Necessary standard applies to all uses and disclosures except treatment purposes, patient requests, disclosures required by law, and disclosures to HHS.
CHISSP CHISSP HIPAA Compliance & Healthcare Data Privacy 1
Under HIPAA, which category of organizations is directly regulated as a 'covered entity'?