Certified in Healthcare Privacy and Security MCQ Flashcards

Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Answer: De-identified health data meeting the Safe Harbor standard

Data that meets the Safe Harbor de-identification standard (removing 18 specified identifiers) is no longer PHI and is not subject to HIPAA protections.

A hospital's Security Officer discovers that a workforce member accessed patient records without a valid treatment, payment, or operations reason. This is BEST described as:

Answer: A workforce sanction policy violation

Inappropriate access by workforce members without authorization violates the workforce sanction policy, which covered entities must have in place under the HIPAA Security Rule.

Which HIPAA Privacy Rule standard allows covered entities to use or disclose PHI for their own treatment, payment, and healthcare operations without patient authorization?

Answer: Permitted uses and disclosures

The permitted uses and disclosures provision allows covered entities to use or disclose PHI for TPO (treatment, payment, healthcare operations) without individual authorization.

A risk analysis under the HIPAA Security Rule must identify threats to the confidentiality, integrity, and availability of ePHI. Which document type formally captures this assessment?

Answer: Risk Assessment Report

The Risk Assessment Report documents identified threats, vulnerabilities, likelihood, and impact, fulfilling the Security Rule's requirement for a formal, documented risk analysis.

Under the HITECH Act, which entity tier has a maximum annual civil monetary penalty of $1.9 million per violation category?

Answer: Willful neglect – not corrected

Willful neglect that is not corrected carries the highest penalty tier, up to $1.9 million per identical violation category per calendar year.

A covered entity receives a subpoena for a patient's medical records. Under HIPAA, the covered entity may disclose PHI in response to the subpoena only if:

Answer: Satisfactory assurances are received that the patient was notified or a protective order is in place

HIPAA permits disclosure in response to a subpoena without a court order only when the covered entity receives satisfactory assurances that the individual was notified or that a qualified protective order is in place.

Which access control mechanism grants permissions based on an individual's role within an organization rather than their specific identity?

Answer: Role-Based Access Control (RBAC)

RBAC assigns permissions according to job roles (e.g., nurse, billing clerk), simplifying administration and supporting the minimum necessary principle required by HIPAA.