CMRT Privacy & Security 3

Question 1

Which federal law specifically protects the confidentiality of substance use disorder treatment records beyond standard HIPAA protections?

Accepted Answer

42 CFR Part 2

Answer

42 CFR Part 2 provides heightened confidentiality protections for records of patients treated for substance use disorders at federally assisted programs.

Question 2

Under the HITECH Act, breach notifications to affected individuals must be sent within:

Accepted Answer

60 days of discovery

Answer

HITECH requires covered entities to notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days from discovery.

Question 3

An EHR audit log is primarily used to:

Accepted Answer

Track who accessed, modified, or deleted records and when

Answer

Audit logs record access activity, enabling organizations to detect unauthorized access, modifications, or deletions of electronic health records.

Question 4

A workforce member who accesses a colleague's health record out of curiosity — without a work-related need — is committing:

Accepted Answer

A HIPAA privacy violation

Answer

Unauthorized access to PHI without a valid work-related reason violates the HIPAA Privacy Rule's minimum necessary and access control requirements.

Question 5

Which entity is responsible for enforcing HIPAA compliance?

Accepted Answer

The Department of Health and Human Services Office for Civil Rights (OCR)

Answer

The HHS Office for Civil Rights (OCR) is the primary federal agency that investigates HIPAA complaints and enforces compliance.

(CMRT) Certified Medical Records Technician Practice Test

(CMRT) Certified Medical Records Technician Practice Test

CMRT Privacy & Security 3