CPCA CPCA Medical Records and HIPAA Privacy 2

Question 1

What document must a patient sign to authorize the release of their PHI to a third party not involved in treatment, payment, or operations?

Accepted Answer

HIPAA Authorization Form

Answer

A signed HIPAA Authorization Form is required before disclosing PHI for purposes outside of treatment, payment, and healthcare operations.

Question 2

Under HIPAA, a 'business associate' is best described as:

Accepted Answer

A vendor or contractor who handles PHI on behalf of a covered entity

Answer

A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity, such as a billing service.

Question 3

What must a dermatology practice provide to new patients at their first visit regarding their privacy rights?

Accepted Answer

Notice of Privacy Practices (NPP)

Answer

Covered entities must provide patients with a Notice of Privacy Practices describing how their PHI may be used and their rights.

Question 4

A dermatology medical biller posts patient names and diagnosis codes on a shared office whiteboard visible to other patients. This is a violation of:

Accepted Answer

HIPAA Privacy Rule

Answer

Displaying patient PHI in areas visible to unauthorized individuals violates the HIPAA Privacy Rule's requirement to safeguard PHI.

Question 5

Which of the following is an example of a HIPAA Security Rule safeguard?

Accepted Answer

Requiring unique user IDs and passwords for electronic health record access

Answer

The HIPAA Security Rule requires technical safeguards such as unique user IDs to control access to electronic PHI (ePHI).

CPCA Exam Practice Test