CHPS HIPAA Privacy Rule Compliance 2

Question 1

Under HIPAA's Right of Access, what is the maximum fee a covered entity may charge for electronic copies of PHI maintained electronically?

Accepted Answer

A fee not exceeding $6.50 per request under the safe harbor

Answer

A flat fee of $25

Answer

A reasonable cost-based fee for labor, supplies, and postage

Answer

No fee may be charged for electronic records

Question 2

Which of the following is considered a permissible purpose for using or disclosing PHI without patient authorization under the HIPAA Privacy Rule?

Accepted Answer

Public health activities such as disease reporting

Answer

Marketing a covered entity's own health services using PHI

Answer

Selling PHI to a data analytics firm

Answer

Sharing PHI with an employer for job performance reviews

Question 3

A Notice of Privacy Practices (NPP) must include which of the following elements?

Accepted Answer

A description of the types of uses and disclosures a covered entity may make

Answer

A list of all workforce members who may access PHI

Answer

The names of all business associates

Answer

Annual audit results of privacy program compliance

Question 4

Under HIPAA, when may a covered entity use PHI for fundraising purposes?

Accepted Answer

When demographic information and dates of service are used and the patient is given an opportunity to opt out

Answer

Never — fundraising requires explicit written authorization

Answer

Only when the patient has opted in to fundraising communications

Answer

Only with de-identified data

Question 5

Which of the following best describes the HIPAA concept of 'treatment, payment, and health care operations' (TPO)?

Accepted Answer

Permitted purposes for PHI use and disclosure that generally do not require patient authorization

Answer

Three categories requiring written patient authorization before PHI disclosure

Answer

Administrative safeguards required by the Security Rule

Answer

Breach categories under the Breach Notification Rule

Question 6

Under the HIPAA Privacy Rule, a covered entity must designate which role to be responsible for developing and implementing its privacy policies?

Accepted Answer

Privacy Officer

Answer

Chief Information Officer (CIO)

Answer

Compliance Officer

Answer

Health Information Manager