CIPP/US Healthcare & Financial Privacy

Question 1

Under HIPAA, 'Protected Health Information' (PHI) is defined as individually identifiable health information that is:

Accepted Answer

Held or transmitted by a covered entity or its business associate in any form or medium

Answer

Only information stored in electronic format

Answer

Only information shared with insurance companies

Answer

Only information contained in a patient's medical chart

Question 2

Which of the following entities are classified as 'covered entities' under the HIPAA Privacy Rule?

Accepted Answer

Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically

Answer

All businesses that store any health-related data

Answer

Only hospitals and large health systems

Answer

Any company that offers employee health benefits

Question 3

The HIPAA Privacy Rule's 'minimum necessary' standard requires covered entities to:

Accepted Answer

Limit PHI uses and disclosures to the minimum necessary to accomplish the intended purpose

Answer

Collect as much patient data as possible for comprehensive care

Answer

Obtain written patient consent before every internal use of PHI

Answer

Delete patient records within one year of the last treatment

Question 4

Under HIPAA, a 'business associate' is best described as:

Accepted Answer

A person or entity that performs functions on behalf of a covered entity that involve the use or disclosure of PHI

Answer

An employee of a covered entity who handles PHI

Answer

A government health oversight agency

Answer

A patient's authorized personal representative

Question 5

The HIPAA Security Rule's requirements apply specifically to which type of protected health information?

Accepted Answer

Electronic protected health information (ePHI) only

Answer

All PHI in any format

Answer

Paper records and verbal communications only

Answer

PHI shared with third parties only

Question 6

Under the HIPAA Privacy Rule, patients have the right to do all of the following EXCEPT:

Accepted Answer

Prohibit all sharing of their PHI for treatment purposes

Answer

Request access to their PHI

Answer

Request an amendment to their PHI

Answer

Receive an accounting of disclosures of their PHI