CHPS HIPAA Privacy Rule Compliance 1 — Questions and Answers
Question 1: Under the HIPAA Privacy Rule, what is the maximum period a covered entity may retain a patient's authorization for use or disclosure of PHI?
- Until the patient revokes it in writing (Correct answer)
- Six years from the date of creation
- One year from the date of signing
- Five years from the date of creation
Correct answer: Until the patient revokes it in writing
An authorization remains valid until the patient revokes it in writing or the expiration date stated in the authorization is reached.
Question 2: Which of the following is NOT considered protected health information (PHI) under HIPAA?
- A patient's diagnosis shared in a treatment record
- De-identified health data that meets the Safe Harbor standard (Correct answer)
- A billing record linking a patient's name to a procedure
- A photograph of a patient taken during treatment
Correct answer: De-identified health data that meets the Safe Harbor standard
Data properly de-identified using the Safe Harbor method (removing all 18 identifiers) is no longer considered PHI under HIPAA.
Question 3: Under the HIPAA Minimum Necessary standard, which of the following disclosures is EXEMPT from the requirement?
- Disclosures to health plan auditors
- Disclosures for treatment purposes to treating providers (Correct answer)
- Disclosures for payment reconciliation
- Disclosures to business associates
Correct answer: Disclosures for treatment purposes to treating providers
The Minimum Necessary standard does not apply to disclosures to or requests by a healthcare provider for treatment purposes.
Question 4: A patient requests an amendment to their medical record under HIPAA. How long does the covered entity have to act on the request?
- 30 days
- 45 days
- 60 days (Correct answer)
- 90 days
Correct answer: 60 days
Under 45 CFR §164.526, a covered entity must act on an amendment request within 60 days of receipt.
Question 5: Which HIPAA provision requires covered entities to provide patients with an accounting of certain disclosures of their PHI?
- Right of Access
- Right to Amend
- Right to an Accounting of Disclosures (Correct answer)
- Right to Request Restrictions
Correct answer: Right to an Accounting of Disclosures
The Right to an Accounting of Disclosures (45 CFR §164.528) requires covered entities to provide a list of disclosures made for purposes other than treatment, payment, and operations.
Question 6: Under HIPAA, which of the following entities is classified as a 'hybrid entity'?
- A hospital that also provides long-term care
- An organization that performs both covered and non-covered functions and designates its healthcare components (Correct answer)
- A business associate that also provides clinical services
- A health plan that covers both dental and medical services
Correct answer: An organization that performs both covered and non-covered functions and designates its healthcare components
A hybrid entity is a single legal entity that performs both covered and non-covered functions and officially designates its healthcare components subject to HIPAA.
CHPS HIPAA Privacy Rule Compliance 1
Under the HIPAA Privacy Rule, what is the maximum period a covered entity may retain a patient's authorization for use or disclosure of PHI?