CMRT Privacy & Security 5

Question 1

What is a 'designated record set' under HIPAA?

Accepted Answer

The medical and billing records used to make decisions about an individual

Answer

A designated record set includes the medical, billing, and other records a covered entity uses to make decisions about individuals, which patients have rights to access and amend.

Question 2

Under HIPAA, psychotherapy notes are treated differently from other medical records because:

Accepted Answer

They require specific patient authorization for most disclosures, separate from the general authorization

Answer

Psychotherapy notes held separately from the medical record receive special protection and generally require patient authorization even for disclosures that are otherwise permissible.

Question 3

A 'chain of trust' agreement in health information exchange ensures that:

Accepted Answer

Each entity in a data-sharing network agrees to protect PHI consistently

Answer

Chain of trust agreements require all participants in a health information network to maintain equivalent privacy and security protections for PHI.

Question 4

Which action best demonstrates the 'physical safeguard' requirements of the HIPAA Security Rule?

Accepted Answer

Restricting access to server rooms with key card entry

Answer

Physical safeguards include facility access controls such as key card entry, locks, and workstation use policies that physically protect electronic PHI.

Question 5

When must a covered entity report a breach affecting 500 or more individuals to HHS and the media?

Accepted Answer

Within 60 days of discovery

Answer

Breaches affecting 500 or more individuals in a state or jurisdiction require notification to HHS and prominent media outlets within 60 calendar days of discovery.

(CMRT) Certified Medical Records Technician Practice Test

(CMRT) Certified Medical Records Technician Practice Test

CMRT Privacy & Security 5