CHPC - Certified in Healthcare Privacy Compliance Healthcare Privacy Laws and Regulations Questions and Answers

Question 1

A research institution wants to use a dataset containing PHI for a study.
To comply with HIPAA, they must de-identify the data.
Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?

Accepted Answer

The Expert Determination Method

Answer

The Safe Harbor Method

Answer

The Minimum Necessary Standard

Answer

The Data Use Agreement Method

Question 2

A patient discovers an error in their medical record and submits a written request to their provider to correct it. Under the HIPAA Privacy Rule, what is the covered entity's primary obligation regarding the patient's right to amend their PHI?

Accepted Answer

To review the request and, if granted, append the correction to the record.

Answer

To immediately delete the incorrect information from the record.

Answer

To inform the patient that medical records cannot be altered once created.

Answer

To charge the patient a fee for the administrative cost of the amendment.

Question 3

A hospital's business associate, a billing company, experiences a data breach involving unsecured PHI. According to the HITECH Act's Breach Notification Rule, what is the business associate's direct responsibility?

Accepted Answer

Notify the covered entity of the breach without unreasonable delay and no later than 60 days following discovery.

Answer

Notify all affected individuals within 60 days of discovering the breach.

Answer

Report the breach directly to the media if more than 500 individuals are affected.

Answer

Wait for the covered entity to discover the breach independently before taking any action.

Question 4

A state has a law requiring that patients provide specific consent for the release of mental health records, a standard more stringent than HIPAA's general authorization requirements. A provider in this state receives a request that is compliant with HIPAA but not with the stricter state law. Which of the following is the correct course of action?

Accepted Answer

Follow the more stringent state law.

Answer

Follow the HIPAA standard because federal law always supersedes state law.

Answer

Disregard both laws and use professional judgment.

Answer

Inform the requestor that the laws are in conflict and no information can be released.

Question 5

A covered entity wishes to send promotional materials to its former patients about a new, non-health-related service, such as a financial planning workshop hosted by a third party. Under the HIPAA Privacy Rule, which of the following is required before using PHI for this purpose?

Accepted Answer

A valid, written authorization from each individual.

Answer

A notice posted in the provider's waiting room.

Answer

An updated Notice of Privacy Practices.

Answer

No specific action, as this is considered a healthcare operation.

Question 6

Which of the following is a mandatory component that must be included in a HIPAA Business Associate Agreement (BAA)?

Accepted Answer

A provision requiring the business associate to make its internal practices available to the Secretary of HHS for compliance determination.

Answer

A requirement for the business associate to carry a minimum level of cybersecurity insurance.

Answer

The specific names of the business associate's privacy and security officers.

Answer

A fixed fee schedule for all services provided by the business associate.

A research institution wants to use a dataset containing PHI for a study.To comply with HIPAA, they must de-identify the data.Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?

A research institution wants to use a dataset containing PHI for a study.
To comply with HIPAA, they must de-identify the data.
Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?