CHPS Trivia 2 — Questions and Answers
Question 1: Under HIPAA, what is the maximum civil monetary penalty per identical violation category per calendar year?
- $100,000
- $500,000
- $1,000,000
- $1,919,173 (Correct answer)
Correct answer: $1,919,173
The HHS annually adjusts the annual cap for identical violations, which as of recent adjustments exceeds $1.9 million per violation category per year.
Question 2: Which federal law enacted in 2009 extended HIPAA privacy and security obligations directly to Business Associates?
- HITECH Act (Correct answer)
- ACA
- ARRA
- GINA
Correct answer: HITECH Act
The Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009 made Business Associates directly liable for HIPAA compliance.
Question 3: What term describes the HIPAA requirement that covered entities use only the minimum amount of PHI necessary to accomplish a task?
- Need-to-know principle
- Minimum necessary standard (Correct answer)
- Least privilege rule
- Data minimization directive
Correct answer: Minimum necessary standard
The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI use, disclosure, and requests to the minimum needed for the intended purpose.
Question 4: How long must covered entities retain HIPAA-required documentation (e.g., policies and procedures)?
- 3 years
- 5 years
- 6 years (Correct answer)
- 10 years
Correct answer: 6 years
HIPAA requires covered entities to retain documentation of policies, procedures, and actions for 6 years from the date of creation or last effective date, whichever is later.
Question 5: Which safeguard category under the HIPAA Security Rule addresses workforce training and security reminders?
- Physical safeguards
- Technical safeguards
- Administrative safeguards (Correct answer)
- Operational safeguards
Correct answer: Administrative safeguards
Administrative safeguards include workforce security training, security reminders, and policies governing workforce conduct regarding ePHI.
Question 6: A patient requests an amendment to their medical record, but the provider believes the record is accurate. What must the provider do?
- Deny the request with no further action
- Accept the amendment automatically
- Deny it in writing and inform the patient of their right to submit a statement of disagreement (Correct answer)
- Report the dispute to HHS
Correct answer: Deny it in writing and inform the patient of their right to submit a statement of disagreement
When denying an amendment request, covered entities must provide a written denial and inform the individual of their right to submit a statement of disagreement.
Question 7: Under the HIPAA Breach Notification Rule, what is the deadline for notifying HHS of a breach affecting fewer than 500 individuals?
- Within 60 days of discovery
- Within 60 days of year-end (Correct answer)
- By March 1 of the following year
- Within 30 days of discovery
Correct answer: Within 60 days of year-end
For breaches affecting fewer than 500 individuals, covered entities may log them and report to HHS within 60 days after the end of the calendar year in which the breach occurred.
CHPS Trivia 2
Under HIPAA, what is the maximum civil monetary penalty per identical violation category per calendar year?