EHR Health Information Privacy & Security 3

Question 1

Under the HIPAA Security Rule, which of the following is categorized as an 'addressable' implementation specification?

Accepted Answer

Encryption and decryption of data at rest

Answer

Encryption of data at rest is an addressable specification, meaning covered entities must implement it or document an equivalent alternative measure.

Question 2

What does the term 'minimum necessary' standard require of covered entities?

Accepted Answer

PHI used or disclosed should be limited to what is needed for the intended purpose

Answer

The minimum necessary standard requires covered entities to limit PHI access and disclosure to only what is needed to accomplish the intended purpose.

Question 3

Which of the following scenarios qualifies as a HIPAA-permitted disclosure without patient authorization?

Accepted Answer

Reporting a gunshot wound to law enforcement as required by state law

Answer

Disclosures required by law, such as mandatory reporting of gunshot wounds to law enforcement, are permitted under HIPAA without patient authorization.

Question 4

A Business Associate Agreement (BAA) is required when a covered entity shares PHI with:

Accepted Answer

A vendor that creates, receives, maintains, or transmits PHI on the entity's behalf

Answer

A BAA is required with any business associate — a vendor or third party that handles PHI on behalf of the covered entity.

Question 5

What is the primary purpose of a Risk Analysis under the HIPAA Security Rule?

Accepted Answer

To identify and assess potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability

Answer

A Risk Analysis is required to systematically identify threats and vulnerabilities that could affect the security of ePHI.

(EHR) Electronic Health Records Program Certification Practice Test

(EHR) Electronic Health Records Program Certification Practice Test

EHR Health Information Privacy & Security 3