Clinical Informatics Certification Privacy & Security Regulations 2

Question 1

Under HIPAA, which type of agreement is required when a covered entity shares PHI with a third-party vendor?

Accepted Answer

Business Associate Agreement

Answer

A Business Associate Agreement (BAA) is required by HIPAA when a covered entity discloses PHI to a third party performing services on its behalf.

Question 2

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals of an unsecured PHI breach within how many days?

Accepted Answer

60 days

Answer

HIPAA requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Question 3

Which HIPAA rule specifically establishes standards for protecting electronic PHI (ePHI) at rest and in transit?

Accepted Answer

Security Rule

Answer

The HIPAA Security Rule establishes national standards for protecting electronic PHI through administrative, physical, and technical safeguards.

Question 4

A hospital's EHR system logs every user access to patient records. This is an example of which HIPAA Security Rule safeguard category?

Accepted Answer

Technical safeguards

Answer

Audit controls and access logging are technical safeguards under the HIPAA Security Rule that record and examine activity in systems containing ePHI.

Question 5

Which federal law governs the privacy of substance use disorder treatment records and is more restrictive than HIPAA?

Accepted Answer

42 CFR Part 2

Answer

42 CFR Part 2 provides stricter confidentiality protections for substance use disorder patient records than HIPAA, requiring patient consent for most disclosures.

Clinical Informatics Certification Practice Test

Clinical Informatics Certification Practice Test

Clinical Informatics Certification Privacy & Security Regulations 2