EHR Health Information Privacy & Security 2

Question 1

Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Accepted Answer

De-identified data that cannot reasonably identify an individual

Answer

De-identified health information that cannot reasonably be used to identify an individual is not considered PHI under HIPAA.

Question 2

A covered entity must provide patients with a Notice of Privacy Practices (NPP) at which point?

Accepted Answer

At first service delivery and upon request thereafter

Answer

HIPAA requires covered entities to provide the NPP at first service delivery and make it available upon request at any subsequent visit.

Question 3

Which access control model grants permissions based on a user's job function within the organization?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Role-Based Access Control (RBAC) assigns system access based on the user's organizational role or job function.

Question 4

What is the maximum penalty per violation category per year under HIPAA's tiered civil monetary penalty structure?

Accepted Answer

$1,500,000

Answer

HIPAA civil monetary penalties are capped at $1,500,000 per violation category per calendar year.

Question 5

An EHR audit log should capture which of the following at minimum?

Accepted Answer

User ID, timestamp, and record accessed

Answer

A compliant EHR audit log must capture at minimum who accessed the record (user ID), when (timestamp), and which record was accessed.

(EHR) Electronic Health Records Program Certification Practice Test