CMRT Privacy & Security 2

Question 1

Under HIPAA, which action constitutes a 'minimum necessary' violation?

Accepted Answer

Sharing a patient's entire medical history when only a lab result was requested

Answer

The minimum necessary standard requires limiting PHI disclosures to only what is needed for the intended purpose.

Question 2

A covered entity's Notice of Privacy Practices (NPP) must be provided to patients:

Accepted Answer

At first service delivery and posted in the facility

Answer

HIPAA requires covered entities to provide the NPP at first contact or service and make it available at their facilities.

Question 3

Which scenario is an example of an 'incidental disclosure' that is permissible under HIPAA?

Accepted Answer

A patient overhearing their name called in a waiting room

Answer

Incidental disclosures that occur as a byproduct of otherwise permissible communications, like calling a patient's name, are allowed if reasonable safeguards are in place.

Question 4

What is the purpose of a HIPAA Business Associate Agreement (BAA)?

Accepted Answer

To legally bind vendors who access PHI to comply with HIPAA safeguards

Answer

A BAA is a contract requiring business associates who handle PHI on behalf of a covered entity to follow HIPAA requirements.

Question 5

Which of the following is NOT one of HIPAA's three categories of safeguards?

Accepted Answer

Financial

Answer

HIPAA's Security Rule specifies administrative, physical, and technical safeguards — financial is not a HIPAA safeguard category.

(CMRT) Certified Medical Records Technician Practice Test

(CMRT) Certified Medical Records Technician Practice Test

CMRT Privacy & Security 2