Clinical Informatics Certification Clinical Informatics Privacy & Ethics 2

Question 1

Under HIPAA, which of the following is considered a 'covered entity'?

Accepted Answer

A health plan that pays for medical services

Answer

A marketing firm that analyzes de-identified health trends

Answer

A cloud storage vendor storing encrypted PHI on behalf of a hospital

Answer

A medical device manufacturer selling devices directly to consumers

Question 2

A researcher wants to use patient data without obtaining individual authorizations. Which HIPAA Privacy Rule provision allows this under specific conditions?

Accepted Answer

Waiver of Authorization by an IRB or Privacy Board

Answer

Minimum Necessary Standard

Answer

Notice of Privacy Practices

Answer

Business Associate Agreement

Question 3

Which concept in clinical informatics ethics refers to a patient's right to make informed decisions about their own health care without coercion?

Accepted Answer

Autonomy

Answer

Beneficence

Answer

Non-maleficence

Answer

Justice

Question 4

A hospital's EHR system automatically logs all user access to patient records. What is the primary purpose of this audit log?

Accepted Answer

To detect and investigate unauthorized access to PHI

Answer

To improve clinical decision support accuracy

Answer

To satisfy billing and coding requirements

Answer

To generate quality improvement reports

Question 5

Which of the following best describes the ethical principle of 'justice' in the context of health information technology?

Accepted Answer

Distributing the benefits and burdens of HIT equitably across populations

Answer

Ensuring EHR systems do not cause patient harm

Answer

Obtaining patient consent before collecting health data

Answer

Disclosing only the minimum necessary information

Question 6

A clinician accesses the EHR record of a celebrity patient out of curiosity without clinical need. This is BEST described as a violation of which HIPAA rule?

Accepted Answer

Privacy Rule — minimum necessary standard

Answer

Security Rule — access control requirements

Answer

Breach Notification Rule — timeliness requirement

Answer

Omnibus Rule — business associate provisions

Question 7

Which of the following is an example of a 'secondary use' of health data that raises ethical concerns?

Accepted Answer

An insurance company purchasing de-identified data to set premium rates

Answer

A physician reviewing a patient's lab results to adjust medication

Answer

A nurse updating medication administration records in the EHR

Answer

A pharmacist verifying drug interactions before dispensing a prescription