Certified in Healthcare Privacy Compliance (CHPC) — Questions and Answers

Question 1: A healthcare organization is implementing a new electronic health record (EHR) system. Which of the following is the MOST critical initial step in managing the privacy implications of this new system?

Training all staff members on the new EHR system's features.
Updating the Notice of Privacy Practices and distributing it to all patients.
Conducting a comprehensive Privacy Impact Assessment (PIA). (Correct answer)
Ensuring the business associate agreement with the EHR vendor is signed.

Correct answer: Conducting a comprehensive Privacy Impact Assessment (PIA).

A Privacy Impact Assessment (PIA) is a foundational tool used to identify and mitigate privacy risks associated with new systems or processes that handle Protected Health Information (PHI). It should be conducted early in the project lifecycle to ensure that privacy considerations are built into the system design ('Privacy by Design'), rather than being addressed after implementation. While training, updating notices, and signing a BAA are all crucial components of privacy program management, the PIA is the most critical *initial* step to understand and address potential privacy risks proactively.

Question 2: Under the HIPAA Safe Harbor method, full 5-digit ZIP codes must generally be removed. Under what specific condition may the first three digits of a ZIP code be retained?

When the ZIP code belongs to a rural county with fewer than 1,000 residents
When the geographic unit formed by the first three digits contains more than 20,000 people (Correct answer)
When the covered entity has obtained a waiver from HHS
When the data is being used solely for internal quality improvement

Correct answer: When the geographic unit formed by the first three digits contains more than 20,000 people

Safe Harbor permits retaining the first three digits of a ZIP code only if the corresponding geographic unit contains more than 20,000 people; otherwise, the digits must be replaced with '000'.

Question 3: Following a material change to a state's data breach notification law that is more stringent than HIPAA, a hospital updates its internal breach response policy. What is the hospital's training obligation under HIPAA in this scenario?

No training is required since the change was prompted by state law, not HIPAA.
Train all workforce members on the new policy within a reasonable period of time. (Correct answer)
Only train members of the designated incident response team, as they are the ones who will use the policy.
Wait until the next scheduled annual training to communicate the policy change to the entire workforce.

Correct answer: Train all workforce members on the new policy within a reasonable period of time.

The HIPAA Privacy Rule at 45 CFR § 164.530(b)(1) requires retraining of the workforce when their functions are affected by a material change in policies or procedures. This training must occur 'within a reasonable period of time after the material change becomes effective.' Since a change in breach response policy affects the duties of many workforce members (i.e., how they must report a suspected breach), they must be trained on the new policy.

Question 4: Under HIPAA's Safe Harbor method, specific dates must be removed EXCEPT which component?

Birth date
Date of death
The year alone (for individuals under 90) (Correct answer)
Admission and discharge dates

Correct answer: The year alone (for individuals under 90)

Safe Harbor requires removing specific dates (birth, admission, discharge, death) but permits retaining the year alone, provided the individual is not 90 years of age or older.

Question 5: Which of the following activities would be considered part of an effective compliance training program?

Providing role-specific compliance training for employees (Correct answer)
Making attendance optional for senior leadership
Offering training in multiple formats (e.g., in-person, online modules) (Correct answer)
Annual training on HIPAA and other applicable regulations (Correct answer)

Correct answer: Providing role-specific compliance training for employees

An effective compliance training program mandates regular, comprehensive training for all employees on relevant laws and regulations, such as HIPAA. Annual training ensures ongoing awareness and understanding of compliance obligations, keeping staff informed about current requirements and organizational policies. This consistent education is foundational to fostering a culture of compliance.

Question 6: Under HIPAA, which two methods are officially recognized for de-identifying protected health information?

Safe Harbor and Expert Determination (Correct answer)
Anonymization and Pseudonymization
Data Masking and Aggregation
Encryption and Tokenization

Correct answer: Safe Harbor and Expert Determination

HIPAA's Privacy Rule recognizes two de-identification methods: Safe Harbor (removing 18 specified identifiers) and Expert Determination (a qualified statistician certifies re-identification risk is very small).

Question 7: What distinguishes a limited data set from fully de-identified data under HIPAA?

A limited data set requires stricter physical safeguards than fully identified PHI
A limited data set retains more direct identifiers than de-identified data
A limited data set can only be used for treatment, not research or operations
A limited data set may retain indirect identifiers such as dates and city-level geographic data (Correct answer)

Correct answer: A limited data set may retain indirect identifiers such as dates and city-level geographic data

Unlike fully de-identified data, a limited data set may retain indirect identifiers like dates, ages, and geographic data at the city, state, or ZIP code level, while all direct identifiers must be removed.

Question 8: When developing a comprehensive privacy program, a Privacy Officer must create numerous policies and procedures. For which of the following documents must the organization retain a copy for at least six years from the date of its creation or the date when it last was in effect, whichever is later?

Individual employee training completion certificates for a single year.
A patient's signed authorization for a one-time disclosure of PHI.
Monthly reports from the network intrusion detection system.
The organization's Notice of Privacy Practices. (Correct answer)

Correct answer: The organization's Notice of Privacy Practices.

HIPAA requires that covered entities retain required documentation, which includes its policies and procedures like the Notice of Privacy Practices, for a minimum of six years from the date of creation or the date it was last in effect, whichever is later.

Question 9: Which of the following demonstrates an organization’s commitment to enforcing compliance standards?

Offering annual bonuses based on departmental performance
Rewarding employees who report compliance concerns
Conducting exit interviews for employees leaving the organization
Developing and implementing disciplinary policies for non-compliance (Correct answer)

Correct answer: Developing and implementing disciplinary policies for non-compliance

An organization's commitment to enforcing compliance standards is most clearly demonstrated by having and consistently applying disciplinary policies for non-compliance. This shows that violations have consequences, reinforcing the importance of adherence to rules and deterring future misconduct. It establishes accountability and seriousness within the compliance program, fostering a culture of integrity.

Question 10: A hospital is developing its annual HIPAA training plan. To ensure the training is as effective as possible and tailored to its workforce, which of the following is the BEST approach?

Creating role-based training modules that address the specific ways different employees interact with PHI in their daily jobs. (Correct answer)
Delivering the exact same comprehensive training module to all workforce members, from clinicians to janitorial staff.
Focusing training exclusively on the IT department, as they manage the electronic systems containing PHI.
Conducting training only for new hires and assuming long-term employees remember their initial training.

Correct answer: Creating role-based training modules that address the specific ways different employees interact with PHI in their daily jobs.

The HIPAA Privacy and Security Rules require that training be 'necessary and appropriate' for workforce members to carry out their functions. A one-size-fits-all approach is less effective than role-based training, which tailors content to the specific risks and responsibilities of different jobs (e.g., clinical staff, billing, IT). This targeted approach enhances comprehension and the practical application of privacy and security principles, making the program more effective.

Question 11: A minor patient's parent requests access to the child's mental health records. Under HIPAA, who controls access in this situation?

Federal law always overrides state law for minor records
Minors have no privacy rights under HIPAA
State law governs, and HIPAA defers to it in most minor-rights scenarios (Correct answer)
HIPAA always grants parents full access to all minor records

Correct answer: State law governs, and HIPAA defers to it in most minor-rights scenarios

HIPAA defers to state law when it comes to a minor's rights and parental access, meaning state statutes on minor confidentiality generally control.

Question 12: Which of the following is considered Protected Health Information (PHI) under HIPAA?

Patient's medical record number (Correct answer)
State of residence without any other identifiers
Email address used for healthcare communication (Correct answer)
Age of a patient over 90 years old (Correct answer)

Correct answer: Patient's medical record number

Under HIPAA, Protected Health Information (PHI) includes any individually identifiable health information. A patient's medical record number is a direct identifier that links health information to a specific individual. Therefore, it is explicitly considered PHI and must be protected according to HIPAA regulations.

Question 13: When developing and implementing privacy policies and procedures for a healthcare organization, the designated Privacy Officer is responsible for ensuring the policies address which of the following core principles?

The marketing department's quarterly goals and advertising strategies.
The 'minimum necessary' standard for the use and disclosure of PHI. (Correct answer)
The cafeteria's weekly menu and dietary options for staff.
The organization's preferred medical billing codes and fee schedules.

Correct answer: The 'minimum necessary' standard for the use and disclosure of PHI.

A central tenet of the HIPAA Privacy Rule is the 'minimum necessary' standard, which requires covered entities to make reasonable efforts to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended purpose. Privacy policies and procedures must be developed to operationalize this requirement, defining the roles of workforce members and the types of PHI they need to access to perform their jobs.

Question 14: Which of the following is a best practice when conducting internal investigations into compliance complaints?

Interviewing only the complainant to maintain confidentiality
Allowing the subject of the investigation to review all evidence in real time
Informing external regulators before the investigation is completed
Documenting all steps, findings, and conclusions of the investigation (Correct answer)

Correct answer: Documenting all steps, findings, and conclusions of the investigation

Thorough documentation is a best practice for internal investigations because it provides a clear, defensible record of the entire process. This includes documenting the complaint, investigation steps, evidence collected, interviews conducted, findings, and conclusions. Such documentation is vital for demonstrating due diligence, supporting corrective actions, and responding to potential regulatory inquiries.

Question 15: A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?

June 11th, the date the Privacy Officer was officially informed.
The date the first affected patient is successfully notified.
June 1st, the date the first indication of a potential breach was detected. (Correct answer)
June 10th, the date unauthorized access was confirmed.

Correct answer: June 1st, the date the first indication of a potential breach was detected.

The date of discovery is defined as the first day on which a breach is known to the covered entity, or, by exercising reasonable diligence, would have been known to the covered entity. This includes knowledge held by any member of the workforce or agent. Therefore, the discovery date is June 1st, when the IT department first detected the anomaly. The 60-day notification clock starts from this date.

Question 16: Under the Expert Determination method, what documentation must the expert maintain to support the de-identification determination?

A Business Associate Agreement with the covered entity
A signed authorization from every patient whose data is included
Documentation of the methods and results supporting the very small risk determination (Correct answer)
An audit log of all workforce members who accessed the dataset

Correct answer: Documentation of the methods and results supporting the very small risk determination

HIPAA requires that the expert document the methods applied and results obtained so the de-identification determination can be reviewed and substantiated if later questioned.

Question 17: During an internal investigation, what is the primary purpose of interviewing witnesses?

To collect evidence to substantiate or disprove allegations (Correct answer)
To determine how the witnesses feel about the compliance program
To identify additional individuals who may be responsible for the violation
To warn employees about possible disciplinary action

Correct answer: To collect evidence to substantiate or disprove allegations

The primary purpose of interviewing witnesses during an internal investigation is to gather relevant information and evidence. Witness testimonies can help corroborate or refute allegations, provide context, and identify other potential sources of information. This process contributes to a comprehensive understanding of the facts surrounding the compliance complaint, aiding in accurate findings.

Question 18: A patient requests an amendment to their medical record. Under HIPAA, how long does the covered entity have to act on this request?

14 days, with no extension
90 days, with a 30-day extension
30 days, with no extension
60 days, with a possible 30-day extension (Correct answer)

Correct answer: 60 days, with a possible 30-day extension

HIPAA allows covered entities 60 days to respond to amendment requests, with one 30-day extension if written notice of the delay is given.

Question 19: A business associate discovers a breach of unsecured PHI that it maintains on behalf of a covered entity. What is the business associate's primary notification responsibility under the HITECH Act?

Report the breach to the HHS Secretary on behalf of the covered entity.
Notify the covered entity without unreasonable delay and in no case later than 60 days of discovery. (Correct answer)
Notify the affected individuals directly within 60 days.
Wait for the covered entity to discover the breach independently through an audit.

Correct answer: Notify the covered entity without unreasonable delay and in no case later than 60 days of discovery.

Under the HITECH Act and the HIPAA Final Omnibus Rule, a business associate must notify the covered entity of a breach of unsecured PHI. This notification allows the covered entity to fulfill its own breach notification duties to individuals, HHS, and potentially the media. The contract (Business Associate Agreement) between the two parties will often specify a shorter timeframe for this internal notification, but the outer limit aligns with the 60-day rule.

Question 20: Which of the following is a primary objective of conducting a periodic privacy risk assessment within a healthcare organization?

To eliminate all potential threats to protected health information (PHI).
To satisfy the requirements for marketing and fundraising activities.
To assign blame for past privacy incidents and breaches.
To identify potential vulnerabilities and threats to the privacy of PHI. (Correct answer)

Correct answer: To identify potential vulnerabilities and threats to the privacy of PHI.

The main purpose of a privacy risk assessment is to proactively identify, analyze, and evaluate potential risks and vulnerabilities to the confidentiality, integrity, and availability of PHI. This process allows an organization to prioritize risks and implement reasonable and appropriate controls to mitigate them. It is not possible to eliminate all risks, and the focus is on identification and mitigation, not assigning blame for past events.

Question 21: Which of the following is NOT among the 18 identifiers that must be removed under HIPAA's Safe Harbor de-identification method?

Telephone numbers
Device identifiers and serial numbers
Medical record numbers
Diagnosis codes (ICD codes) (Correct answer)

Correct answer: Diagnosis codes (ICD codes)

ICD diagnosis codes are clinical codes that describe conditions, not personal identifiers; the 18 Safe Harbor identifiers target information that can be used to identify a specific individual.

Question 22: Under the HIPAA Safe Harbor method, which geographic data element may be retained in de-identified data?

Street address
Full 5-digit ZIP code
County name
The state (Correct answer)

Correct answer: The state

Safe Harbor requires removal of all geographic subdivisions smaller than a state, but the state itself may be retained in de-identified information.

Question 23: A large health system acquires a small, independent clinic. As part of integrating the clinic into the health system's privacy program, what is a critical first step for the health system's Privacy Officer?

Conduct a gap analysis of the clinic's existing privacy policies and practices against the health system's standards. (Correct answer)
Require all clinic patients to sign new authorizations for the release of their information.
Shut down the clinic's IT systems until they can be fully migrated to the health system's platform.
Immediately replace all of the clinic's staff with health system employees.

Correct answer: Conduct a gap analysis of the clinic's existing privacy policies and practices against the health system's standards.

Before integrating a new entity, a privacy officer must understand its current state of compliance. A gap analysis is a systematic review that compares the acquired clinic's privacy policies, procedures, and actual practices to the health system's established standards and regulatory requirements. This assessment identifies deficiencies and areas of non-compliance that must be remediated to ensure the entire organization operates under a consistent and compliant privacy program.

Question 24: A patient's right to access their PHI under HIPAA applies to which of the following?

Only physician-authored notes
Any document mentioning the patient anywhere in the facility
Only billing records
A designated record set maintained by the covered entity (Correct answer)

Correct answer: A designated record set maintained by the covered entity

The right of access applies specifically to PHI contained in a designated record set, which includes medical records and billing records used for decisions about the individual.

Question 25: Under HIPAA, which entity is required to sign a Business Associate Agreement (BAA) with a covered entity?

Any vendor that provides services to the covered entity regardless of PHI access
Only vendors that store PHI in the cloud
Only vendors that handle electronic PHI
A vendor that creates, receives, maintains, or transmits PHI on behalf of the covered entity (Correct answer)

Correct answer: A vendor that creates, receives, maintains, or transmits PHI on behalf of the covered entity

A BAA is required with any business associate that creates, receives, maintains, or transmits PHI while performing services on behalf of the covered entity.

Question 26: A health insurance company discovers a server misconfiguration that exposed the PHI of 600 members, all of whom reside in the state of Texas. The company has already planned for individual notifications and notification to HHS. What additional notification responsibility does the company have?

Publish a notice on the homepage of its website for at least 90 days.
Notify the Federal Trade Commission (FTC) due to the number of individuals affected.
Notify the state's governor's office and attorney general via certified mail.
Notify prominent media outlets serving the state of Texas. (Correct answer)

Correct answer: Notify prominent media outlets serving the state of Texas.

Under the HIPAA Breach Notification Rule, if a breach of unsecured PHI affects more than 500 residents of a single state or jurisdiction, the covered entity must provide notice to prominent media outlets serving that state or jurisdiction. This notification must be provided without unreasonable delay and no later than 60 days after discovery. Website posting is an alternative for insufficient contact information, not a primary requirement in this case.

Question 27: A healthcare organization experiences a data breach involving the exposure of unencrypted PHI. What steps must they take according to the HIPAA Breach Notification Rule?

Report the breach to the Office for Civil Rights (OCR) (Correct answer)
Notify affected individuals within 60 days of discovering the breach (Correct answer)
Notify local law enforcement immediately
Provide notification to the media if the breach affects more than 500 individuals (Correct answer)

Correct answer: Report the breach to the Office for Civil Rights (OCR)

According to the HIPAA Breach Notification Rule, healthcare organizations must notify affected individuals within 60 days of discovering a breach involving unencrypted PHI. This notification informs individuals about the breach and the steps they can take to protect themselves. Additionally, breaches affecting more than 500 individuals require notification to the media and the Office for Civil Rights (OCR).

Question 28: The NIST Privacy Framework is designed to help organizations manage privacy risk. It is distinct from but complementary to cybersecurity frameworks. What is a primary focus of the NIST Privacy Framework?

Managing risks arising from authorized data processing activities, such as collection, use, and disclosure. (Correct answer)
Certifying that an organization is fully compliant with all state and federal privacy laws.
Mandating specific encryption standards for data at rest and in transit.
Exclusively managing risks from unauthorized access by external hackers.

Correct answer: Managing risks arising from authorized data processing activities, such as collection, use, and disclosure.

The NIST Privacy Framework is a tool for managing privacy risks throughout the entire data lifecycle. A key distinction is its focus on risks arising from authorized data processing (i.e., how data is collected, stored, used, and shared), not just from unauthorized access or security breaches. It helps organizations build patient trust by managing data ethically and in predictable ways.

Question 29: A hospital employee leaves a laptop containing unencrypted ePHI in their car, and it is stolen. What must the organization do under the HIPAA Breach Notification Rule?

Only notify individuals if more than 500 records are involved
Notify affected individuals, the OCR, and possibly the media (Correct answer)
Wait to see if the data is accessed before taking action
Do nothing if the car was locked

Correct answer: Notify affected individuals, the OCR, and possibly the media

This scenario describes a breach of unsecured ePHI, as the laptop was unencrypted and stolen. Under the HIPAA Breach Notification Rule, organizations must notify affected individuals without unreasonable delay. If the breach affects 500 or more individuals, notification to the OCR and the media is also required, making this the comprehensive correct action.

Question 30: Which of the following scenarios would NOT be considered a HIPAA violation?

A doctor shares PHI with a business associate under a signed Business Associate Agreement (BAA) (Correct answer)
A billing clerk accesses a patient’s record without a legitimate need
A nurse discusses a patient’s condition with a friend without authorization
A receptionist leaves a list of patient names and phone numbers in a public area

Correct answer: A doctor shares PHI with a business associate under a signed Business Associate Agreement (BAA)

A doctor sharing PHI with a business associate under a signed Business Associate Agreement (BAA) is not considered a HIPAA violation. A BAA is a legally required contract that ensures the business associate will appropriately safeguard the PHI they receive or create on behalf of the covered entity. This agreement allows for necessary data sharing while maintaining HIPAA compliance.

Question 31: Which of the following frameworks, while not mandatory for all healthcare organizations, provides a voluntary, risk-based approach with core functions like 'Identify, Protect, Detect, Respond, Recover' that is widely recognized and cross-walked to the HIPAA Security Rule?

NIST Cybersecurity Framework (CSF) (Correct answer)
HITRUST CSF
ISO 27001
COBIT Framework

Correct answer: NIST Cybersecurity Framework (CSF)

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is a voluntary framework that provides a structured, risk-based approach to cybersecurity. Its core functions ('Identify, Protect, Detect, Respond, Recover') are widely adopted in healthcare, and HHS has provided a crosswalk to demonstrate how its use can help support compliance with the HIPAA Security Rule.

Question 32: Under the HITECH Act, which entity extended individual rights regarding PHI to business associates?

Business associates are now directly liable for honoring certain patient rights (Correct answer)
Only covered entities retain direct patient rights obligations
Business associates have no patient rights obligations
State attorneys general enforce BA patient rights only

Correct answer: Business associates are now directly liable for honoring certain patient rights

HITECH made business associates directly liable under HIPAA, including obligations related to individual rights such as access and accounting of disclosures.

Question 33: A hospital discovers that a former employee accessed the medical records of a celebrity patient without a valid reason after their employment was terminated. According to the HIPAA Breach Notification Rule, what is the hospital's primary obligation after containing the incident and performing a risk assessment?

Terminate the employee's supervisor for lack of oversight.
Wait for the celebrity patient to contact the hospital with a complaint.
Notify the affected individual, the Secretary of HHS, and potentially the media without unreasonable delay. (Correct answer)
Only notify the hospital's legal counsel to prepare for a potential lawsuit.

Correct answer: Notify the affected individual, the Secretary of HHS, and potentially the media without unreasonable delay.

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay, and in no case later than 60 days, following the discovery of a breach of unsecured PHI. If the breach affects 500 or more individuals, the Secretary of HHS must be notified concurrently, and prominent media outlets serving the area must also be notified. Waiting for a complaint or only notifying legal counsel would violate these federal requirements.

Question 34: What is the primary privacy risk that HIPAA's de-identification standard is designed to mitigate?

Loss of data integrity during electronic transmission
Unauthorized access to encrypted health information systems
Re-identification of individuals from health data disclosed or released externally (Correct answer)
Unauthorized modification of medical records by workforce members

Correct answer: Re-identification of individuals from health data disclosed or released externally

De-identification is specifically designed to prevent re-identification of individuals when health data is shared for research, public health, or other secondary purposes.

Question 35: Which HIPAA right permits an individual to request that a covered entity communicate with them at a specific location or by a specific method?

Right to confidential communications (Correct answer)
Right to amend
Right to access
Right to accounting

Correct answer: Right to confidential communications

The right to confidential communications allows individuals to ask covered entities to contact them through alternative means or at alternative locations.

Question 36: Which of the following best describes the 'minimum necessary' standard as it applies to business associates?

The minimum necessary standard applies only to covered entities, not business associates
Business associates must limit PHI use and disclosure to what is necessary for the contracted purpose (Correct answer)
Business associates must use PHI minimally but are exempt from disclosure limits
Business associates may use all PHI they receive without restriction

Correct answer: Business associates must limit PHI use and disclosure to what is necessary for the contracted purpose

Business associates are required to apply the minimum necessary standard, using and disclosing only the PHI needed to fulfill their contracted function.

Question 37: Which statement MOST accurately describes de-identified health information under HIPAA?

De-identified data is subject to the Security Rule's technical safeguard requirements
De-identified data retains some Privacy Rule protections, such as the minimum necessary standard
De-identified data is not subject to the HIPAA Privacy Rule and may be freely used and disclosed (Correct answer)
De-identified data must be described in the organization's Notice of Privacy Practices

Correct answer: De-identified data is not subject to the HIPAA Privacy Rule and may be freely used and disclosed

Once properly de-identified under HIPAA standards, the information is no longer PHI and falls entirely outside the Privacy Rule's scope, including minimum necessary, authorization, and NPP requirements.

Question 38: Which of the following is a critical, non-technical component of an effective privacy training and awareness program within a healthcare organization?

Establishing a sanction policy for workforce members who fail to comply with privacy policies. (Correct answer)
Deploying an intrusion detection system to monitor for malicious activity.
Conducting annual penetration testing of the organization's network.
Implementing multi-factor authentication for all systems containing ePHI.

Correct answer: Establishing a sanction policy for workforce members who fail to comply with privacy policies.

While technical safeguards are vital, an effective privacy program must also include administrative components. A sanction policy is a required administrative safeguard under HIPAA that establishes consequences for non-compliance, reinforcing the importance of training and adherence to privacy policies among the workforce.

Question 39: A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?

A brief description of the steps individuals should take to protect themselves from potential harm. (Correct answer)
A formal apology from the organization's CEO.
The name of the specific workforce member who caused the breach.
An offer of at least one year of complimentary credit monitoring services.

Correct answer: A brief description of the steps individuals should take to protect themselves from potential harm.

The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.

Question 40: When a covered entity shares a limited data set, what agreement must be executed with the recipient?

Business Associate Agreement
Confidentiality and Non-Disclosure Agreement
Data Use Agreement (Correct answer)
Memorandum of Understanding

Correct answer: Data Use Agreement

HIPAA requires a Data Use Agreement (DUA) between the covered entity and any recipient of a limited data set, specifying permitted uses and prohibiting re-identification attempts.

Question 41: A patient submits a written request to restrict how their PHI is used for treatment purposes. The covered entity may:

Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule) (Correct answer)
Never deny a restriction request
Grant the restriction only for payment uses
Deny the restriction for treatment uses

Correct answer: Grant or deny the restriction at its discretion (except the mandatory out-of-pocket rule)

For most restriction requests, covered entities have discretion to agree or disagree, with the exception of the mandatory restriction when a patient pays fully out of pocket.

Question 42: What is the purpose of conducting a compliance risk assessment in a healthcare organization?

To develop the organization's cybersecurity protocols
To meet the requirements for HIPAA Security Rule compliance
To prepare annual financial reports for the leadership team
To identify areas of non-compliance and prioritize risk mitigation (Correct answer)

Correct answer: To identify areas of non-compliance and prioritize risk mitigation

The primary purpose of a compliance risk assessment is to proactively identify potential areas where an organization may not be meeting regulatory requirements or internal policies. By understanding these risks, the organization can then prioritize and implement appropriate mitigation strategies. This process helps prevent violations and ensures adherence to laws and regulations, strengthening the overall compliance posture.

Question 43: What is the best way to safeguard PHI on mobile devices such as laptops or smartphones?

Installing antivirus software and firewalls (Correct answer)
Allowing unrestricted use of personal devices for PHI access
Using strong passwords or biometric authentication
Implementing encryption for PHI (Correct answer)

Correct answer: Installing antivirus software and firewalls

Implementing encryption for PHI is considered the best way to safeguard data on mobile devices. Encryption renders the information unreadable and unusable to unauthorized individuals if the device is lost or stolen, providing a strong layer of protection directly to the data itself. While other measures like strong passwords and antivirus are important, encryption directly addresses the risk of data compromise.

Question 44: What happens to a BAA if the underlying covered entity–business associate relationship ends?

The BA must return or destroy all PHI and confirm compliance to the covered entity (Correct answer)
No action is required as long as the BA keeps PHI secure
The BA may retain PHI indefinitely for its own business records
The BAA automatically extends for one additional year

Correct answer: The BA must return or destroy all PHI and confirm compliance to the covered entity

Upon termination of the relationship, the business associate must return or destroy all PHI and certify that no copies have been retained, unless retention is legally required.

Question 45: What is the main purpose of the HIPAA Privacy Rule?

To ensure healthcare organizations have strong cybersecurity controls
To prevent fraud and abuse in healthcare
To create standardized electronic health record (EHR) systems
To establish national standards for protecting individuals’ medical records and PHI (Correct answer)

Correct answer: To establish national standards for protecting individuals’ medical records and PHI

The main purpose of the HIPAA Privacy Rule is to establish national standards for protecting individuals' medical records and other Protected Health Information (PHI). It grants patients rights over their health information, including the right to access and amend their records, and sets limits on who can access and use PHI. This rule ensures the confidentiality and security of sensitive patient data across the healthcare industry.

Question 46: Under HIPAA, which of the following is an example of a business associate acting outside the scope of its BAA?

Providing PHI only to workforce members who need it for the contracted service
Reporting a breach to the covered entity within 60 days
Encrypting PHI at rest as required by the Security Rule
Using patient data to market the BA's own services without authorization (Correct answer)

Correct answer: Using patient data to market the BA's own services without authorization

Using PHI for the BA's own marketing purposes goes beyond the contracted service and violates both the BAA and HIPAA's permitted use restrictions.

Question 47: Which of the following entities is considered a business associate under HIPAA?

A covered entity's own workforce members
An individual providing incidental services with no PHI access
A cloud service provider that stores PHI for a covered entity (Correct answer)
A healthcare clearinghouse transmitting claims on behalf of itself

Correct answer: A cloud service provider that stores PHI for a covered entity

Cloud service providers that store or process PHI on behalf of covered entities are business associates and require a BAA.

Question 48: Which of the following situations would most likely be considered an exception to the HIPAA definition of a "breach" and therefore not trigger notification requirements, provided no further impermissible disclosure occurs?

An unencrypted laptop containing the PHI of 300 patients is stolen from an employee's locked office.
A third-party transcription vendor emails unencrypted patient notes to the wrong clinic, which is not a business associate.
A billing clerk intentionally accesses the record of a celebrity patient and sells the information to a tabloid.
A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record. (Correct answer)

Correct answer: A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record.

The HIPAA Breach Notification Rule includes an exception for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed impermissibly. The nurse realizing the error and immediately closing the record fits this exception. The other options represent clear potential or actual breaches requiring a full risk assessment.

Question 49: Under HIPAA, psychotherapy notes receive special protection. Which statement best describes this?

They may be accessed freely for treatment purposes without any restriction
They are excluded from HIPAA coverage entirely
They are treated identically to other medical records
They require a separate, specific authorization from the patient for most disclosures (Correct answer)

Correct answer: They require a separate, specific authorization from the patient for most disclosures

Psychotherapy notes are separately defined and require a specific patient authorization for most disclosures, beyond the general authorization used for other PHI.

Question 50: According to the HIPAA Privacy Rule, a covered entity must document that training has been provided. How long must these training records be retained?

For six years from the date of its creation or the date it was last in effect, whichever is later. (Correct answer)
Indefinitely, as they may be needed for future litigation.
For at least three years from the date of the training session.
For the duration of the employee's tenure with the organization.

Correct answer: For six years from the date of its creation or the date it was last in effect, whichever is later.

Both the HIPAA Privacy Rule (45 CFR § 164.530(j)(2)) and the Security Rule (45 CFR § 164.316(b)(2)(i)) mandate that documentation, including training records, must be retained for a minimum of six years from the date of its creation or the date when it last was in effect, whichever is later.

Question 51: Which of the following is NOT required as a physical safeguard under HIPAA?

Limiting access to areas containing PHI
Installing security cameras to monitor PHI access
Keeping printed medical records in locked storage
Encrypting PHI stored on mobile devices (Correct answer)

Correct answer: Encrypting PHI stored on mobile devices

Encryption of PHI stored on mobile devices is classified as a technical safeguard under HIPAA, not a physical safeguard. Physical safeguards focus on protecting physical access to electronic information systems and the facilities that house them, such as limiting access to areas and securing physical records. Technical safeguards, like encryption, protect ePHI within electronic systems by controlling access and ensuring data integrity.

Question 52: A research institution wants to use a dataset containing PHI for a study. To comply with HIPAA, they must de-identify the data. Which of the following methods relies on a qualified statistician to apply scientific principles to determine that the risk of re-identification is 'very small'?

The Safe Harbor Method
The Minimum Necessary Standard
The Data Use Agreement Method
The Expert Determination Method (Correct answer)

Correct answer: The Expert Determination Method

The HIPAA Privacy Rule provides two methods for de-identification. The Expert Determination Method involves a qualified expert applying statistical or scientific principles to determine that the risk is 'very small' that the information could be used to identify an individual. The Safe Harbor method involves removing 18 specific identifiers.

Question 53: A hospital's privacy officer is reviewing contracts with a new telehealth platform vendor. The vendor claims it is a 'conduit' and does not need a BAA. The privacy officer should:

Require only a confidentiality agreement instead of a BAA
Accept the vendor's claim and proceed without a BAA
File a complaint with HHS before proceeding
Evaluate whether the vendor stores or accesses PHI content beyond mere transmission before accepting the conduit claim (Correct answer)

Correct answer: Evaluate whether the vendor stores or accesses PHI content beyond mere transmission before accepting the conduit claim

The conduit exception is narrow and applies only to entities that transport PHI without accessing its content; a telehealth platform that processes or stores PHI does not qualify.

Question 54: A compliance officer is explaining the distinction between HIPAA's Risk Analysis and Risk Management requirements to a new privacy analyst. Which statement BEST summarizes the relationship between these two components?

Risk Analysis and Risk Management are interchangeable terms for the same ongoing process of vulnerability scanning.
Risk Analysis is the process of identifying and evaluating potential risks and vulnerabilities, whereas Risk Management is the process of implementing measures to reduce those identified risks. (Correct answer)
Risk Analysis is the process of purchasing insurance to transfer risk, while Risk Management is the process of accepting residual risk.
Risk Analysis involves implementing security controls, and Risk Management is the process of documenting those controls.

Correct answer: Risk Analysis is the process of identifying and evaluating potential risks and vulnerabilities, whereas Risk Management is the process of implementing measures to reduce those identified risks.

The HIPAA Security Rule requires two distinct but related actions: risk analysis and risk management. Risk analysis is the 'diagnostic' phase of identifying and evaluating risks to ePHI. Risk management is the subsequent 'treatment' phase, where the organization implements security measures to reduce the identified risks to a reasonable and appropriate level.

Question 55: Which of the following is a mandatory component of a security awareness and training program as required by the HIPAA Security Rule's Administrative Safeguards (45 CFR § 164.308)?

A policy requiring all patient communication to occur via encrypted email.
A mandatory annual, 8-hour in-person workshop for all staff.
Implementation of biometric scanners for all workstation logins.
Procedures for guarding against, detecting, and reporting malicious software. (Correct answer)

Correct answer: Procedures for guarding against, detecting, and reporting malicious software.

The HIPAA Security Rule at 45 CFR § 164.308(a)(5) requires a security awareness and training program. One of the addressable implementation specifications under this standard is 'Protection from malicious software,' which requires having procedures for guarding against, detecting, and reporting malware. While other options can be good security practices, they are not specific, mandatory components of the training program itself as outlined in this section of the rule.

Question 56: A nurse accesses the electronic health record (EHR) of a friend who is admitted to the hospital without a work-related reason. <br> What type of safeguard failure does this represent?

Physical safeguard failure
Physical safeguard failure (Correct answer)
There is no failure if the nurse does not share the information Answer: B
Administrative safeguard failure

Correct answer: Physical safeguard failure

This scenario could be considered a physical safeguard failure if the nurse gained access to the EHR through a workstation that was not adequately secured according to the organization's physical safeguard policies. For example, if a workstation was left logged in or in an area accessible to the nurse without proper authorization, allowing them to physically sit down and access the system. While the act of accessing the data is electronic, the vulnerability could stem from a lack of physical workstation security.

Question 57: A Privacy Officer is tasked with ensuring their organization's audit controls are compliant with the HIPAA Security Rule. Which of the following best describes the function of 'audit controls' in this context?

Implementing mechanisms to record and examine activity in information systems that contain or use ePHI. (Correct answer)
The formal, external review of financial records by a certified public accountant.
Assigning a unique name or number for identifying and tracking user identity.
Preventing unauthorized physical access to facilities where ePHI is stored.

Correct answer: Implementing mechanisms to record and examine activity in information systems that contain or use ePHI.

The HIPAA Security Rule requires covered entities to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems containing ePHI. These are known as audit controls and are crucial for detecting and responding to security incidents.

Question 58: A hospital's business associate, a billing company, experiences a data breach involving unsecured PHI. According to the HITECH Act's Breach Notification Rule, what is the business associate's direct responsibility?

Notify the covered entity of the breach without unreasonable delay and no later than 60 days following discovery. (Correct answer)
Wait for the covered entity to discover the breach independently before taking any action.
Report the breach directly to the media if more than 500 individuals are affected.
Notify all affected individuals within 60 days of discovering the breach.

Correct answer: Notify the covered entity of the breach without unreasonable delay and no later than 60 days following discovery.

Under the HITECH Act, a business associate must notify the covered entity of a breach of unsecured PHI 'without unreasonable delay and in no case later than 60 calendar days' after discovery. The covered entity is ultimately responsible for notifying the affected individuals, HHS, and, if applicable, the media.

Question 59: Which format must a covered entity use when a patient requests an electronic copy of PHI maintained in an electronic health record (EHR)?

The format requested by the patient, if readily producible (Correct answer)
Only PDF format regardless of request
Plain text only
The entity's preferred internal format

Correct answer: The format requested by the patient, if readily producible

Covered entities must provide the electronic copy in the format requested by the patient if it is readily producible; otherwise, they must offer an agreed-upon alternative.

Question 60: What rights does a patient have under the HIPAA Privacy Rule?

The right to access and obtain copies of their medical records (Correct answer)
The right to receive a list of disclosures of their PHI (Correct answer)
The right to request an amendment to their medical records (Correct answer)
The right to delete all their PHI upon request

Correct answer: The right to access and obtain copies of their medical records

Under the HIPAA Privacy Rule, patients have several fundamental rights regarding their health information. One key right is the ability to access and obtain copies of their medical records, allowing them to review and understand their health information. This empowers patients to be informed participants in their healthcare decisions and ensures transparency.

Question 61: A hospital's electronic health record (EHR) system experiences a network outage, preventing clinicians from using their standard credentials. To ensure patient care continues, the organization must have a pre-established method for accessing necessary ePHI. Which HIPAA Security Rule standard specifically addresses this requirement?

Audit Controls
Automatic Logoff
Emergency Access Procedure (Correct answer)
Unique User Identification

Correct answer: Emergency Access Procedure

The HIPAA Security Rule's Technical Safeguards require covered entities to establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency. This is the 'Emergency Access Procedure' standard, which is a required implementation specification under the Access Control standard, designed for situations where normal access methods fail.

Question 62: A patient asks a covered entity to restrict the disclosure of their PHI to their health plan for a service they paid for out of pocket. Under HIPAA, the covered entity must:

Honor the restriction (Correct answer)
Evaluate the request and decide
Request physician approval first
Deny the request as health plans are required recipients

Correct answer: Honor the restriction

HIPAA requires covered entities to agree to restrictions on disclosures to health plans when the patient paid out of pocket in full for the service.

Question 63: Which of the following is a permitted use of PHI by a business associate WITHOUT requiring additional patient authorization?

Disclosing PHI to another covered entity for their treatment purposes
Using PHI for the specific services described in the BAA with the covered entity (Correct answer)
Using PHI to create a new commercial database product
Selling PHI to a marketing firm for research purposes

Correct answer: Using PHI for the specific services described in the BAA with the covered entity

A business associate may only use or disclose PHI as permitted by its BAA with the covered entity or as required by law.

Question 64: Which of the following is a core patient right guaranteed under the HIPAA Privacy Rule?

The right to audit the healthcare provider's internal security logs.
The right to demand deletion of their entire medical record.
The right to access and obtain a copy of their protected health information (PHI). (Correct answer)
The right to veto any disclosure of their PHI for treatment, payment, or healthcare operations.

Correct answer: The right to access and obtain a copy of their protected health information (PHI).

The HIPAA Privacy Rule provides individuals with the right to access, inspect, and obtain a copy of their PHI from a covered entity in a designated record set. While they can request amendments, they cannot demand complete deletion of records that providers are legally required to maintain. Their right to restrict disclosures for TPO (Treatment, Payment, Operations) is limited, and they do not have a right to audit internal security logs.

Question 65: A patient discovers an error in their medical record and submits a written request to their provider to correct it. Under the HIPAA Privacy Rule, what is the covered entity's primary obligation regarding the patient's right to amend their PHI?

To charge the patient a fee for the administrative cost of the amendment.
To immediately delete the incorrect information from the record.
To review the request and, if granted, append the correction to the record. (Correct answer)
To inform the patient that medical records cannot be altered once created.

Correct answer: To review the request and, if granted, append the correction to the record.

The HIPAA Privacy Rule gives individuals the right to request amendment of their PHI in a designated record set. The covered entity is not required to delete the original information but must, if it accepts the amendment, append the corrected information and notify relevant parties. The entity can deny the request for specific reasons, such as if it determines the record is accurate and complete.

Question 66: A HIPAA privacy officer is conducting a third-party vendor risk assessment. Which element should be PRIORITIZED in evaluating a new cloud vendor?

The vendor's pricing tier and market share
The number of other healthcare clients the vendor serves
Whether the vendor will sign a HIPAA-compliant BAA and has documented security controls (Correct answer)
Whether the vendor has a U.S.-based headquarters

Correct answer: Whether the vendor will sign a HIPAA-compliant BAA and has documented security controls

The most critical factors are the vendor's willingness to sign a compliant BAA and evidence of security controls that protect PHI.

Question 67: Which of the following is NOT required to be included in a Business Associate Agreement?

Obligation to return or destroy PHI upon termination
Requirements to report breaches to the covered entity
Permitted uses and disclosures of PHI by the business associate
The business associate's liability insurance coverage amount (Correct answer)

Correct answer: The business associate's liability insurance coverage amount

HIPAA mandates specific BAA provisions about permitted uses, safeguards, breach reporting, and PHI disposition, but does not require disclosure of the BA's insurance coverage.

Question 68: Under HIPAA, a covered entity may charge a fee for providing a copy of PHI to a patient. Which cost element is NOT allowable?

Cost of the physical media (e.g., a USB drive)
Labor for copying
Staff time to locate and pull the record (Correct answer)
Postage

Correct answer: Staff time to locate and pull the record

HIPAA's fee limitation allows only labor for copying, supplies, postage, and preparation of a summary — searching and retrieving costs are not chargeable.

Question 69: A pharmaceutical company offers to pay a hospital for a list of patients diagnosed with a specific condition to send them marketing materials about a new drug. Under HIPAA marketing rules, what must the hospital do before disclosing this PHI?

Obtain a valid, written authorization from each individual patient. (Correct answer)
De-identify the patient data before providing it.
Enter into a Business Associate Agreement with the pharmaceutical company.
Notify the patients of the marketing communication via their Notice of Privacy Practices.

Correct answer: Obtain a valid, written authorization from each individual patient.

The HIPAA Privacy Rule defines this type of communication as marketing, especially since the hospital receives remuneration. For nearly all marketing purposes that involve the use or disclosure of PHI and involve payment to the covered entity, a specific, written authorization from the patient is required. A Business Associate Agreement or a notice in the NPP is insufficient for this purpose.

Question 70: Which scenario does NOT require a Business Associate Agreement?

A U.S. Postal Service carrier that incidentally delivers paper PHI on behalf of a covered entity (Correct answer)
A legal firm providing services involving review of patient records
An IT firm that manages EHR servers for a hospital
A medical billing company processing insurance claims

Correct answer: A U.S. Postal Service carrier that incidentally delivers paper PHI on behalf of a covered entity

HIPAA explicitly exempts transmission-only entities like the USPS from the business associate definition when they are not accessing PHI content.

Question 71: A Privacy Officer is reviewing the organization's HIPAA Security Rule contingency plan to ensure all required components are present. Which of the following collections of plans MUST be included?

A data backup plan, a disaster recovery plan, and an emergency mode operation plan. (Correct answer)
A facility security plan, a workstation use policy, and a device and media control plan.
An access control plan, an audit control plan, and a transmission security plan.
A security incident response plan, a breach notification plan, and a workforce sanction plan.

Correct answer: A data backup plan, a disaster recovery plan, and an emergency mode operation plan.

The HIPAA Security Rule's Contingency Plan standard (an Administrative Safeguard) mandates several implementation specifications. Three of these required specifications are a data backup plan, a disaster recovery plan, and an emergency mode operation plan, which are essential for ensuring ePHI is protected and accessible during and after an emergency.

Question 72: May a covered entity re-identify data that it previously de-identified under HIPAA?

Yes, but only with written authorization from each patient whose data was de-identified
No, because any re-identification attempt constitutes a HIPAA violation
No, because re-identification permanently destroys the original PHI link
Yes, if it retains a separate code or key that links back to the original PHI, kept securely and not disclosed (Correct answer)

Correct answer: Yes, if it retains a separate code or key that links back to the original PHI, kept securely and not disclosed

HIPAA permits covered entities to retain a re-identification code, provided the code cannot be derived from the PHI itself and the key is kept secure and not disclosed.

Question 73: A privacy officer is performing a breach risk assessment after an unencrypted laptop was stolen from an employee's car. The laptop contained a spreadsheet with the names, medical record numbers, and birth dates of 200 patients. Which of the following, if true, would be the STRONGEST mitigating factor in this assessment?

The laptop was remotely wiped within an hour of the theft, and the wipe was confirmed successful. (Correct answer)
The employee immediately reported the theft to the police and the privacy officer.
The organization has a policy requiring encryption, which the employee violated.
The laptop was password-protected at the operating system level.

Correct answer: The laptop was remotely wiped within an hour of the theft, and the wipe was confirmed successful.

The fourth factor of a HIPAA breach risk assessment is the extent to which the risk has been mitigated. Successfully and verifiably wiping the device remotely ensures that the data was destroyed and could not be acquired or viewed, which is the most effective mitigation strategy among the choices. While reporting and passwords are good practices, they do not eliminate the risk that the data was accessed like a confirmed remote wipe does.

Question 74: Under the Safe Harbor method, how must the age of an individual who is 90 years or older be reported in a de-identified dataset?

Their exact age must be removed entirely from the record
Their age must be grouped into an aggregate category such as '90 or older' (Correct answer)
Their age must be encrypted rather than removed
Their age must be replaced with the dataset's mean age

Correct answer: Their age must be grouped into an aggregate category such as '90 or older'

The Safe Harbor method requires that individuals aged 90 or older have their age collapsed into a single category (e.g., '90 or older') because extreme ages can uniquely identify an individual.

Question 75: Under the Expert Determination method of de-identification, what must the qualified expert certify?

That all 18 Safe Harbor identifiers have been removed
That the dataset contains fewer than 100 records
That the risk of identifying any individual is very small using generally accepted statistical principles (Correct answer)
That the data has been encrypted using FIPS 140-2 compliant algorithms

Correct answer: That the risk of identifying any individual is very small using generally accepted statistical principles

Under Expert Determination, a person with statistical or scientific knowledge must apply generally accepted principles and document that the probability of identifying an individual is very small.

Question 76: A Privacy Officer is developing a policy based on the 'Minimum Necessary' standard. Which of the following scenarios best demonstrates the correct application of this HIPAA principle?

Allowing the entire nursing staff to have full access to all patient electronic health records to ensure efficient care.
Releasing a patient's name and general condition to a reporter without the patient's authorization.
Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims. (Correct answer)
Providing a health insurance company with a patient's complete medical history to process a claim for a single office visit.

Correct answer: Granting a hospital's billing clerk access only to the demographic and insurance information needed to process claims.

The 'Minimum Necessary' standard, a key principle of the HIPAA Privacy Rule, requires covered entities to take reasonable steps to limit the use or disclosure of, and requests for, PHI to the minimum necessary to accomplish the intended purpose. Granting a billing clerk access only to the specific data elements required for their job function is a perfect example of this role-based access control. The other options represent overly broad disclosures of PHI.

Question 77: What is the primary purpose of including indemnification clauses in a Business Associate Agreement from the covered entity's perspective?

To shift financial liability to the business associate for PHI breaches caused by the BA's actions (Correct answer)
To exempt the business associate from the Security Rule
To satisfy a CMS billing requirement
To allow the covered entity to avoid all HIPAA penalties

Correct answer: To shift financial liability to the business associate for PHI breaches caused by the BA's actions

Indemnification clauses protect the covered entity by requiring the business associate to bear costs and liabilities arising from PHI breaches attributable to the BA's conduct.

Question 78: A healthcare clinic is relocating to a new facility, and its IT department is moving servers and backup tapes containing ePHI. According to the HIPAA Security Rule's Physical Safeguards, which of the following is a key requirement for managing this process?

Encrypting all data on the servers and tapes prior to the move.
Notifying all patients of the clinic's change of address and potential data risk.
Performing a full risk analysis of the new facility's network infrastructure before connecting devices.
Maintaining a record of the movement of the hardware and electronic media. (Correct answer)

Correct answer: Maintaining a record of the movement of the hardware and electronic media.

The HIPAA Security Rule's Physical Safeguards include the Device and Media Controls standard. A specification under this standard requires policies and procedures that govern the movement of hardware and electronic media. While not a 'required' specification, maintaining a record of these movements is a critical part of accountability to ensure ePHI is tracked and protected during transport.

Question 79: Which of the following is a key element of an effective healthcare compliance program?

Implementing cybersecurity software
Using encrypted emails for internal communication
Designating a Compliance Officer and Compliance Committee (Correct answer)
Ensuring all staff sign confidentiality agreements annually

Correct answer: Designating a Compliance Officer and Compliance Committee

A key element of an effective healthcare compliance program, as outlined by the OIG, is the designation of a Compliance Officer and a Compliance Committee. These roles are crucial for overseeing the program, ensuring its implementation, and providing leadership and guidance on compliance matters within the organization. They establish accountability and structure for the program's success.

Question 80: Under HIPAA, how long does a covered entity generally have to respond to a patient's request for access to their PHI?

15 days, with a 15-day extension
30 days, with a possible 30-day extension (Correct answer)
60 days, with no extension
45 days, with no extension

Correct answer: 30 days, with a possible 30-day extension

HIPAA requires covered entities to act on an access request within 30 days, with one 30-day extension if written notice is provided.

Question 81: A privacy officer learns that a business associate experienced a ransomware attack that encrypted PHI. Under HIPAA, this event is presumed to be:

A breach unless the BA can demonstrate a low probability that PHI was compromised (Correct answer)
A security incident but not a reportable breach
A breach only if patient data was exported outside the BA's network
Not a breach because the PHI was not accessed, only encrypted

Correct answer: A breach unless the BA can demonstrate a low probability that PHI was compromised

HHS guidance indicates ransomware attacks on PHI are presumed breaches because access by an unauthorized actor is implied unless the BA can rebut the presumption.

Question 82: What is the first step a Compliance Officer should take upon receiving a compliance-related complaint?

Begin disciplinary action against the individual identified in the complaint
Determine if the complaint involves a potential violation of laws, regulations, or policies (Correct answer)
Immediately report the complaint to the Office for Civil Rights (OCR)
Notify the entire staff to determine if similar issues have occurred

Correct answer: Determine if the complaint involves a potential violation of laws, regulations, or policies

Upon receiving a compliance-related complaint, the Compliance Officer's first step is to assess the nature of the complaint to determine if it alleges a violation of applicable laws, regulations, or internal policies. This initial evaluation is crucial for categorizing the complaint, understanding its scope, and deciding on the appropriate next steps for investigation. This ensures resources are directed effectively.

Question 83: According to the HIPAA Omnibus Final Rule, when an impermissible use or disclosure of unsecured Protected Health Information (PHI) occurs, what is the presumed status of the incident at the start of an investigation?

The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise. (Correct answer)
The incident is not a breach unless significant harm to the individual can be proven.
The incident is only a breach if it involves more than one individual's PHI.
The incident is presumed to be a result of accidental employee error and does not require a formal risk assessment.

Correct answer: The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise.

The HITECH Act, as implemented by the Omnibus Rule, establishes a rebuttable presumption that any impermissible use or disclosure of unsecured PHI is a breach. The burden of proof is on the covered entity or business associate to demonstrate through a documented four-factor risk assessment that there is a low probability the PHI has been compromised.

Question 84: A large health system is planning to implement a new enterprise-wide electronic health record (EHR) system. To proactively identify and mitigate potential privacy risks before the system goes live, which of the following tools is MOST appropriate to use?

A breach risk assessment
A Privacy Impact Assessment (PIA) (Correct answer)
A security risk analysis
A business continuity plan

Correct answer: A Privacy Impact Assessment (PIA)

A Privacy Impact Assessment (PIA) is a systematic process used to identify and mitigate potential privacy risks associated with new projects, systems, or technologies before they are implemented. A security risk analysis focuses on vulnerabilities to ePHI, a breach risk assessment is conducted after an impermissible disclosure occurs, and a business continuity plan addresses operational recovery, not proactive privacy risk identification.

Question 85: A covered entity is drafting a Business Associate Agreement (BAA) with a new cloud storage vendor. According to HIPAA, which of the following is a mandatory provision that the BAA must contain regarding the business associate's duties?

The business associate must implement appropriate administrative, physical, and technical safeguards. (Correct answer)
The business associate must ensure all its employees complete the covered entity's specific HIPAA training module.
The business associate must conduct a penetration test annually and provide the full report to the covered entity.
The business associate must use the same brand of firewall and antivirus software as the covered entity.

Correct answer: The business associate must implement appropriate administrative, physical, and technical safeguards.

A compliant Business Associate Agreement must state that the business associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by the contract. This explicitly includes implementing the requirements of the HIPAA Security Rule (administrative, physical, and technical safeguards) for any ePHI it handles.

Question 86: A business associate receives a subpoena for PHI. What should it do first?

Immediately comply with the subpoena to avoid legal penalty
Disclose only after the patient provides written consent
Notify the covered entity and review whether disclosure is permitted under the BAA or law (Correct answer)
Refuse the subpoena entirely until HHS approves the disclosure

Correct answer: Notify the covered entity and review whether disclosure is permitted under the BAA or law

Business associates should consult their BAA and notify the covered entity before disclosing, since the BA's permitted disclosures are governed by the agreement and applicable law.

Question 87: Which right allows patients to receive a list of disclosures of their PHI made by a covered entity in the past six years?

Right to restrict
Right of accounting of disclosures (Correct answer)
Right to amend
Right of access

Correct answer: Right of accounting of disclosures

The HIPAA right of accounting of disclosures allows individuals to request a log of certain PHI disclosures made without their authorization.

Question 88: Under HITECH, business associates are directly liable for which of the following?

HIPAA Privacy Rule provisions only when acting outside the BAA scope
Only civil penalties assigned by the covered entity
Meeting state insurance commission standards
Compliance with the HIPAA Security Rule's required and addressable safeguards (Correct answer)

Correct answer: Compliance with the HIPAA Security Rule's required and addressable safeguards

HITECH made business associates directly subject to the HIPAA Security Rule and certain Privacy Rule provisions, meaning HHS OCR can penalize them directly.

Question 89: A covered entity wishes to send promotional materials to its former patients about a new, non-health-related service, such as a financial planning workshop hosted by a third party. Under the HIPAA Privacy Rule, which of the following is required before using PHI for this purpose?

A notice posted in the provider's waiting room.
A valid, written authorization from each individual. (Correct answer)
An updated Notice of Privacy Practices.
No specific action, as this is considered a healthcare operation.

Correct answer: A valid, written authorization from each individual.

Using or disclosing PHI for marketing purposes generally requires a specific, written authorization from the individual. This authorization must be in plain language and clearly state how the information will be used. Communications about third-party products or services that involve remuneration are considered marketing and are not covered under treatment, payment, or healthcare operations exceptions.

Question 90: When must a covered entity inform a patient that it cannot provide access to their PHI in electronic form?

Within 90 days of the request
At the time the entity denies or cannot fulfill the electronic format request (Correct answer)
Before the patient submits the request
Only if the patient asks about electronic availability

Correct answer: At the time the entity denies or cannot fulfill the electronic format request

Covered entities must inform individuals when electronic PHI is not available in the requested format so the patient may choose an alternative.

Question 91: If an internal investigation uncovers a significant compliance violation, which of the following steps should occur?

Close the investigation and ensure no documentation is kept for confidentiality
Conduct staff retraining to prevent future occurrences (Correct answer)
Implement corrective actions to address the violation (Correct answer)
Report the violation to the appropriate regulatory authority, if required (Correct answer)

Correct answer: Conduct staff retraining to prevent future occurrences

When a significant compliance violation is uncovered, the most critical immediate step is to implement corrective actions. These actions directly address the identified violation, aiming to stop the non-compliant behavior, remediate any harm, and prevent its recurrence. This demonstrates the organization's commitment to resolving issues and maintaining compliance, forming the foundation for further steps like reporting or retraining.

Question 92: A patient submits a complaint that their PHI was accessed without authorization. What is the healthcare provider’s responsibility under HIPAA?

Wait for the Office for Civil Rights (OCR) to request further details
Report the complaint to the media within 48 hours
Investigate the complaint to confirm if a HIPAA breach occurred (Correct answer)
Immediately fire the staff member accused of the violation

Correct answer: Investigate the complaint to confirm if a HIPAA breach occurred

When a patient complains about unauthorized PHI access, the healthcare provider has a responsibility under HIPAA to promptly investigate the claim. This investigation is necessary to determine if a breach of unsecured protected health information actually occurred and to assess its nature and extent. Only after confirming a breach can appropriate further actions, such as notification, be taken.

Question 93: A researcher wants to use de-identified patient data for a clinical study. Which statement about HIPAA requirements is accurate?

De-identified data can only be used after the Privacy Officer approves each study
De-identified data may be used for research without HIPAA authorization requirements (Correct answer)
An IRB waiver is required before accessing any de-identified health data
A patient's written authorization is still required for de-identified research data

Correct answer: De-identified data may be used for research without HIPAA authorization requirements

Because de-identified data is no longer PHI, the HIPAA Privacy Rule's authorization requirements do not apply, and researchers may use or receive it without patient authorization.

Question 94: A hospital employee accidentally faxes a patient's discharge summary, which includes their name, diagnosis, and treatment plan, to a local grocery store instead of the correct post-acute care facility. When conducting the mandatory four-factor breach risk assessment, which factor is most significantly elevated by the recipient being a grocery store?

Whether the PHI was actually acquired or viewed.
The nature and extent of the PHI involved.
The unauthorized person who received the PHI. (Correct answer)
The extent to which the risk to the PHI has been mitigated.

Correct answer: The unauthorized person who received the PHI.

Under the four-factor breach risk assessment, the identity of the unauthorized recipient is a critical factor. A recipient like a grocery store has no obligation to protect the PHI, increasing the risk of compromise compared to another HIPAA-covered entity that has its own legal and ethical duties to safeguard the information.

Question 95: When a covered entity discovers that a business associate has materially breached the BAA and the violation has not been cured, what must the covered entity do?

Suspend the BAA for 60 days while investigating
Notify the affected patients directly
File an immediate complaint with HHS OCR
Terminate the contract with the business associate if feasible (Correct answer)

Correct answer: Terminate the contract with the business associate if feasible

HIPAA requires the covered entity to terminate the contract if a business associate materially breaches the BAA and does not cure the breach when feasible.

Question 96: Which document formally authorizes a business associate to use PHI for a purpose not specified in the original BAA?

A BAA amendment or addendum signed by both parties (Correct answer)
A verbal agreement between the privacy officers
An internal policy change by the business associate
A notification to HHS OCR

Correct answer: A BAA amendment or addendum signed by both parties

Any new permitted use or disclosure of PHI outside the original BAA scope requires a written amendment or addendum executed by both the covered entity and the business associate.

Question 97: As part of managing a privacy program, the Privacy Officer is responsible for developing and implementing policies and procedures. According to the HIPAA Privacy Rule, which of the following areas requires a specific policy that identifies which workforce members need access to PHI to carry out their duties?

Patient's right to request an amendment of their PHI.
The 'Minimum Necessary' standard for internal access and use. (Correct answer)
The technical specifications for encrypting data at rest.
The process for reporting a breach to the media.

Correct answer: The 'Minimum Necessary' standard for internal access and use.

The HIPAA Privacy Rule's 'Minimum Necessary' standard requires a covered entity to develop policies and procedures that identify the persons or classes of persons who need access to PHI, the categories of PHI they need, and any conditions appropriate to such access to perform their jobs.

Question 98: An employee at a physician's office is found to have accessed the medical record of a coworker out of curiosity, with no legitimate job-related reason. This is a clear violation of the organization's privacy policy. Which HIPAA Administrative Safeguard requires the organization to have a formal policy for addressing this employee's misconduct?

Sanction Policy (Correct answer)
Security Incident Procedures
Information Access Management
Security Awareness and Training

Correct answer: Sanction Policy

The HIPAA Security Rule's Administrative Safeguards require a covered entity to 'Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.' This is a required implementation specification known as the Sanction Policy.

Question 99: Which of the following is NOT a valid reason for a covered entity to deny a patient access to their PHI?

A privacy board approved denial
A licensed provider believes access could cause harm
The PHI was created by another provider (Correct answer)
The information was compiled for litigation

Correct answer: The PHI was created by another provider

The fact that PHI was created by another provider is not a valid HIPAA basis for denying patient access; the covered entity must still provide access to PHI it holds.

Question 100: A deceased patient's executor requests access to the decedent's medical records. HIPAA allows covered entities to disclose this PHI to:

Law enforcement only
No one; all PHI expires at death
A personal representative of the decedent, such as an executor (Correct answer)
Only the decedent's physician

Correct answer: A personal representative of the decedent, such as an executor

HIPAA permits disclosure of a decedent's PHI to their personal representative, such as an executor or administrator of the estate.

Question 101: A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025. The clinic provides timely notification to the affected individuals. What is the latest date the clinic must notify the Secretary of HHS?

Notification to HHS is not required for breaches affecting fewer than 500 individuals.
Within 60 days of discovering the breach.
Immediately, but no later than 30 business days from discovery.
Within 60 days of the end of the 2025 calendar year. (Correct answer)

Correct answer: Within 60 days of the end of the 2025 calendar year.

For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS of such breaches annually. These reports are due no later than 60 days after the end of the calendar year in which the breaches were discovered.

Question 102: What is an example of a technical safeguard under the HIPAA Security Rule?

Conducting workforce HIPAA privacy training
Implementing encryption for electronic Protected Health Information (ePHI) (Correct answer)
Conducting periodic risk assessments
Securing access to physical records in locked cabinets

Correct answer: Implementing encryption for electronic Protected Health Information (ePHI)

Technical safeguards under the HIPAA Security Rule refer to the technology and policies used to protect electronic Protected Health Information (ePHI) and control access to it. Implementing encryption for ePHI is a prime example of a technical safeguard. Encryption renders the data unreadable and unusable to unauthorized individuals, significantly enhancing its security during transmission and storage.

Question 103: Under the HIPAA Safe Harbor method, how many specific categories of identifiers must be removed to achieve de-identification?

15
18 (Correct answer)
12
21

Correct answer: 18

The Safe Harbor method requires removal of exactly 18 categories of identifiers, including names, geographic data smaller than a state, dates, phone numbers, Social Security numbers, and biometric identifiers.

Question 104: A Privacy Officer is evaluating the organization's training program and notices that while annual training is conducted, there is no ongoing reinforcement. Which action would most effectively create a continuous culture of awareness?

Terminating employees who fail the annual training quiz on the first attempt.
Increasing the length of the annual training from one hour to three hours.
Requiring all employees to re-sign the confidentiality agreement every quarter.
Implementing periodic security reminders, such as posters, newsletter articles, and simulated phishing emails. (Correct answer)

Correct answer: Implementing periodic security reminders, such as posters, newsletter articles, and simulated phishing emails.

An effective awareness program is continuous, not a single annual event. The HIPAA Security Rule includes 'Security Reminders' as an addressable implementation specification. Using periodic reminders, simulated phishing exercises, and other forms of ongoing communication helps keep security and privacy top-of-mind and fosters a stronger culture of awareness than a single, longer training session would.

Question 105: A hospital discovers that a billing employee impermissibly accessed the electronic health records of 550 patients out of curiosity. According to the HITECH Act's breach notification rule, which of the following actions is the hospital required to take?

Notify the Secretary of HHS and local law enforcement within 60 days of discovery.
Report the breach in the annual report to the Secretary of HHS and notify the affected individuals.
Notify only the affected individuals and the hospital's internal compliance officer.
Notify the affected individuals, the Secretary of HHS, and prominent media outlets in the state. (Correct answer)

Correct answer: Notify the affected individuals, the Secretary of HHS, and prominent media outlets in the state.

The HITECH Act requires covered entities to notify affected individuals, the Secretary of Health and Human Services (HHS), and, in cases involving more than 500 residents of a single state or jurisdiction, prominent media outlets. The notification must occur without unreasonable delay and no later than 60 days from the breach's discovery. Since this breach affected 550 patients, all three notification requirements are triggered.

Question 106: Which action by a covered entity constitutes retaliation prohibited under HIPAA?

Refusing to treat a patient who has overdue bills
Declining an amendment request with a written explanation
Threatening a patient for exercising their right to file a complaint with HHS (Correct answer)
Sharing PHI with a business associate under a signed BAA

Correct answer: Threatening a patient for exercising their right to file a complaint with HHS

HIPAA prohibits covered entities from retaliating against individuals who exercise their rights, including filing complaints with the Department of Health and Human Services.

Question 107: A hospital's Privacy Officer receives a verbal complaint from a patient who believes their PHI was impermissibly shared. What is the most appropriate FIRST step the Privacy Officer or their designee should take in handling this complaint?

Immediately report the potential breach to the Office for Civil Rights (OCR).
Offer the patient a financial settlement to resolve the issue quickly.
Ask the patient to submit the complaint in writing and begin an internal investigation. (Correct answer)
Discipline the employee accused of the impermissible sharing.

Correct answer: Ask the patient to submit the complaint in writing and begin an internal investigation.

Standard procedure for handling patient complaints is to take them seriously, document them, and conduct a thorough internal investigation. It is a best practice to ask the patient to submit the complaint in writing to ensure clarity and proper documentation before taking further action like reporting or disciplinary measures.

Question 108: Which entity is responsible for performing the Expert Determination analysis under HIPAA's de-identification standard?

An Institutional Review Board (IRB) with expertise in health data privacy
A person with appropriate knowledge of generally accepted statistical and scientific principles (Correct answer)
The covered entity's Privacy Officer or Chief Compliance Officer
The U.S. Department of Health and Human Services (HHS)

Correct answer: A person with appropriate knowledge of generally accepted statistical and scientific principles

The Expert Determination method requires a qualified statistician or scientist to apply generally accepted principles—HHS and the IRB are not designated to perform this determination.

Question 109: A healthcare organization is conducting its annual HIPAA Security Rule risk analysis. Which of the following is the PRIMARY objective of this process?

To eliminate all possible threats to electronic protected health information (ePHI).
To satisfy the Meaningful Use core objective for protecting electronic health information.
To purchase a certified Electronic Health Record (EHR) technology.
To identify and implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. (Correct answer)

Correct answer: To identify and implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level.

The primary goal of a HIPAA Security Rule risk analysis is not to eliminate all risks, which is impossible, but to identify potential risks and vulnerabilities and implement security measures to reduce those risks to a reasonable and appropriate level for the organization's specific environment.

Question 110: What is the role of auditing and monitoring in a healthcare compliance program?

To evaluate the effectiveness of the compliance program and detect non-compliance (Correct answer)
To prevent cyberattacks and data breaches on patient information systems
To ensure financial audits are completed accurately and on time
To identify instances of fraud, waste, or abuse before they occur

Correct answer: To evaluate the effectiveness of the compliance program and detect non-compliance

Auditing and monitoring are critical components of a compliance program designed to regularly assess whether the program is functioning as intended. These activities help identify weaknesses, detect instances of non-compliance, and ensure that policies and procedures are being followed. This allows for timely corrective actions and continuous improvement of the compliance program's effectiveness.

Question 111: A business associate hires a subcontractor who will have access to PHI. What must the business associate do?

Obtain written approval from the covered entity before hiring the subcontractor
Execute a BAA with the subcontractor that provides equivalent PHI protections (Correct answer)
Nothing, as subcontractors are not covered by HIPAA
Simply notify the covered entity that a subcontractor will be used

Correct answer: Execute a BAA with the subcontractor that provides equivalent PHI protections

Business associates must obtain satisfactory assurances (via a BAA) from subcontractors that they will appropriately safeguard the PHI they handle.

Question 112: Which of the following is included in the disclosures that must appear in an accounting of disclosures?

Disclosures for the facility directory
Disclosures made for treatment with patient authorization
Disclosures to the patient themselves
Disclosures for public health activities without authorization (Correct answer)

Correct answer: Disclosures for public health activities without authorization

Accounting of disclosures covers disclosures made without patient authorization for purposes such as public health, law enforcement, and oversight activities.

Question 113: A state has a law requiring that patients provide specific consent for the release of mental health records, a standard more stringent than HIPAA's general authorization requirements. A provider in this state receives a request that is compliant with HIPAA but not with the stricter state law. Which of the following is the correct course of action?

Follow the HIPAA standard because federal law always supersedes state law.
Follow the more stringent state law. (Correct answer)
Disregard both laws and use professional judgment.
Inform the requestor that the laws are in conflict and no information can be released.

Correct answer: Follow the more stringent state law.

The HIPAA Privacy Rule acts as a federal floor for privacy protection. It does not preempt state laws that are 'more stringent,' meaning those that provide greater privacy protections to individuals. In this case, the provider must comply with the state law that offers greater protection to the patient's information.

Question 114: Which of the following identifiers is specifically included among the 18 Safe Harbor categories that must be removed?

Patient satisfaction survey responses
Vehicle identifiers and serial numbers (Correct answer)
Health plan premium amounts
Job title and employer name

Correct answer: Vehicle identifiers and serial numbers

Vehicle identifiers and serial numbers are explicitly listed among the 18 Safe Harbor identifiers, as they can be traced back to a registered owner.

Question 115: A hospital wants to share patient data for public health research while retaining ZIP codes and admission dates. What type of dataset does this represent under HIPAA?

Encrypted PHI governed by a Business Associate Agreement
Fully de-identified dataset under Safe Harbor
PHI requiring individual patient authorization
Limited data set requiring a Data Use Agreement (Correct answer)

Correct answer: Limited data set requiring a Data Use Agreement

Because ZIP codes and admission dates are retained—permissible in limited data sets but not in Safe Harbor de-identified data—this qualifies as a limited data set requiring a Data Use Agreement.

Question 116: A new medical assistant is hired at a busy outpatient clinic. According to HIPAA requirements, when must this employee receive initial training on the clinic's privacy and security policies?

Within the first 90 days of employment, during their probationary period.
Only after they have been involved in a minor privacy incident to ensure the training is relevant.
At the end of their first year of employment, combined with their annual performance review.
Within a reasonable period after joining the workforce, and ideally before being granted unsupervised access to PHI. (Correct answer)

Correct answer: Within a reasonable period after joining the workforce, and ideally before being granted unsupervised access to PHI.

The HIPAA Privacy Rule states that training must be provided to each new workforce member 'within a reasonable period of time after the person joins the covered entity's workforce.' Best practice, and the logical interpretation of this rule, is to train employees before they are put in a position where they could mishandle PHI, especially without supervision.

Question 117: Which of the following is a mandatory component that must be included in a HIPAA Business Associate Agreement (BAA)?

A fixed fee schedule for all services provided by the business associate.
A requirement for the business associate to carry a minimum level of cybersecurity insurance.
A provision requiring the business associate to make its internal practices available to the Secretary of HHS for compliance determination. (Correct answer)
The specific names of the business associate's privacy and security officers.

Correct answer: A provision requiring the business associate to make its internal practices available to the Secretary of HHS for compliance determination.

A compliant Business Associate Agreement must include several key elements, one of which is establishing that the business associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services (HHS) to determine compliance with HIPAA. While insurance and fee schedules are good business practices, they are not explicitly required elements of a BAA by HIPAA.

Question 118: What is a 'limited data set' under HIPAA's Privacy Rule?

PHI with all 18 Safe Harbor identifiers removed
PHI with direct identifiers removed but some indirect identifiers such as dates retained (Correct answer)
Encrypted PHI accessible only to authorized workforce members
Fully anonymized health information with no remaining identifiers

Correct answer: PHI with direct identifiers removed but some indirect identifiers such as dates retained

A limited data set has direct identifiers (names, addresses, phone numbers, SSNs) removed, but may retain indirect identifiers such as dates, ages, and geographic information at the city, state, or ZIP code level.

Question 119: A hospital's janitorial staff discards unshredded patient documents containing names, diagnoses, and account numbers into a publicly accessible dumpster. This event constitutes a breach. Which specific safeguard failure is MOST directly responsible for this type of incident?

Failure of technical access controls on the electronic health record system.
Failure of the organization's disaster recovery plan.
Failure to implement proper policies for the final disposition of PHI. (Correct answer)
Failure to obtain patient authorization for research purposes.

Correct answer: Failure to implement proper policies for the final disposition of PHI.

Both the HIPAA Privacy and Security Rules require covered entities to implement reasonable safeguards for PHI in any form. This includes having and implementing policies and procedures for the final disposition of PHI, such as shredding or otherwise destroying documents to render them unreadable and unreconstructible before they are discarded.

Question 120: Which of the following is NOT one of the three types of safeguards required by the HIPAA Security Rule?

Administrative Safeguards
Procedural Safeguards (Correct answer)
Technical Safeguards
Physical Safeguards

Correct answer: Procedural Safeguards

The HIPAA Security Rule specifies three categories of safeguards that covered entities and their business associates must implement to protect electronic protected health information (ePHI). These are Administrative, Physical, and Technical Safeguards. 'Procedural Safeguards' is not a defined category under the Security Rule, although procedures are a component of the required administrative safeguards.

Certified in Healthcare Privacy Compliance (CHPC)

The CHPC certification validates expertise in healthcare privacy regulations, policies, and compliance programs, covering HIPAA Privacy Rule, HITECH Act, breach notification, vendor management, training programs, and privacy investigations. It is administered by the Compliance Certification Board (CCB) through HCCA.

120

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds