CHP HITECH Act & Electronic Health Records Compliance 2

Question 1

What are the four tiers of civil monetary penalties established by HITECH, listed from least to most severe?

Accepted Answer

Did not know, reasonable cause, willful neglect corrected, willful neglect not corrected

Answer

Unaware, negligent, reckless disregard, intentional harm

Answer

Minor, moderate, major, critical violation

Answer

Tier A, Tier B, Tier C, Tier D with escalating fines

Question 2

Under HITECH's breach notification rule, what is the maximum timeframe for notifying affected individuals after discovery of a breach?

Accepted Answer

60 days

Answer

30 days

Answer

45 days

Answer

90 days

Question 3

Under HITECH, when must breaches affecting fewer than 500 individuals be reported to the Secretary of HHS?

Accepted Answer

Annually, within 60 days after the end of each calendar year

Answer

Within 60 days of discovering each individual breach

Answer

Within 90 days of the end of the fiscal year

Answer

Only upon direct request from HHS investigators

Question 4

Which HITECH provision requires a covered entity to honor a patient's request to restrict disclosure of PHI to a health plan?

Accepted Answer

The right to restrict disclosures when a patient pays out of pocket in full

Answer

The minimum necessary standard restriction

Answer

The notice of privacy practices amendment requirement

Answer

The individual access expansion provision

Question 5

What is the purpose of Health Information Exchanges (HIEs) as promoted under the HITECH Act?

Accepted Answer

To enable secure electronic sharing of patient health information across organizations to improve care coordination

Answer

To replace all paper-based records with digital equivalents by a federal deadline

Answer

To serve as backup data storage for EHR systems during outages

Answer

To process insurance claims and remittance advice electronically

Question 6

Which of the following workforce actions would most likely result in criminal penalties under HIPAA as strengthened by HITECH?

Accepted Answer

Intentionally accessing and selling patient records for personal financial gain

Answer

Accidentally sending a patient appointment reminder to the wrong email address

Answer

Failing to encrypt an internal email containing PHI

Answer

Sharing a login password with a trusted colleague temporarily

Question 7

Under HITECH, which element is NOT required to be included in a breach notification letter sent to affected individuals?

Accepted Answer

The name and title of the specific employee responsible for the breach

Answer

A description of what happened and the types of PHI involved

Answer

Steps individuals should take to protect themselves from potential harm

Answer

Contact information and toll-free number for individuals to ask questions