CHPC Privacy Program Management 5

Question 1

A covered entity must mitigate harmful effects of a known privacy violation. Which action BEST reflects the mitigation standard?

Accepted Answer

Retrieving misdirected PHI and obtaining assurances from the recipient that it was destroyed

Answer

Section 164.530(f) requires mitigation, to the extent practicable, of harmful effects, such as retrieving or securing improperly disclosed PHI.

Question 2

For a breach affecting 500 or more residents of a single state, which notification is required in addition to individual and HHS notice?

Accepted Answer

Notice to prominent media outlets serving that state or jurisdiction

Answer

The Breach Notification Rule requires media notice when a breach involves more than 500 residents of a state or jurisdiction.

Question 3

Which program element addresses federal confidentiality rules for substance use disorder treatment records that may exceed HIPAA requirements?

Accepted Answer

42 CFR Part 2 compliance

Answer

42 CFR Part 2 governs confidentiality of federally assisted SUD program records and imposes requirements beyond HIPAA.

Question 4

Which of the following must a covered entity document about privacy complaints it receives?

Accepted Answer

All complaints received and their disposition, if any

Answer

Section 164.530(d)(2) requires documenting all complaints received and their disposition.

Question 5

A privacy officer is building a data inventory as a program foundation. What is its PRIMARY value?

Accepted Answer

It identifies where PHI resides, how it flows, and who accesses it, enabling risk-based controls

Answer

A data inventory and flow map shows PHI locations and movements, which drives risk assessment and control placement.

CHPC - Certified in Healthcare Privacy Compliance Practice Test