CTC Regulatory Compliance & Privacy Standards 2

Question 1

Under HIPAA, which of the following is considered a permissible disclosure of PHI without patient authorization?

Accepted Answer

Sharing PHI with a business associate under a signed BAA

Answer

HIPAA permits disclosure of PHI to business associates when a Business Associate Agreement (BAA) is in place.

Question 2

A telehealth coordinator receives a patient request to access their own medical records within a telehealth portal. Under HIPAA, the covered entity must respond within:

Accepted Answer

30 calendar days, with one 30-day extension if needed

Answer

HIPAA requires covered entities to act on access requests within 30 days, with one permissible 30-day extension.

Question 3

Which federal law specifically governs the confidentiality of substance use disorder patient records in a telehealth context?

Accepted Answer

42 CFR Part 2

Answer

42 CFR Part 2 provides stricter confidentiality protections for substance use disorder treatment records than standard HIPAA rules.

Question 4

A telehealth platform vendor stores encrypted patient session recordings. Under HIPAA, this vendor is best classified as a:

Accepted Answer

Business associate

Answer

A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate under HIPAA.

Question 5

When conducting a HIPAA Security Risk Analysis for a telehealth program, which step must be completed FIRST?

Accepted Answer

Identify all ePHI the organization creates, receives, maintains, or transmits

Answer

The Security Rule requires organizations to first identify where ePHI exists before assessing threats and vulnerabilities.

(CTC) Certified Telehealth Coordinator Practice Test

(CTC) Certified Telehealth Coordinator Practice Test

CTC Regulatory Compliance & Privacy Standards 2