HAC Healthcare Analytics Policy & Compliance 2

Question 1

Under HIPAA's Minimum Necessary Standard, a healthcare analyst requesting a full patient dataset for a quality improvement project should:

Accepted Answer

Request only the data elements needed to accomplish the specific analytical purpose

Answer

Request all available data fields to ensure completeness

Answer

Obtain verbal consent from each patient before accessing records

Answer

Submit the request to the Office for Civil Rights for pre-approval

Question 2

Which federal law governs the privacy and security of substance use disorder patient records, often requiring stricter protections than HIPAA?

Accepted Answer

42 CFR Part 2

Answer

21 CFR Part 11

Answer

45 CFR Part 164

Answer

38 CFR Part 17

Question 3

A healthcare organization experiences a breach affecting 600 patients' PHI. Under HIPAA Breach Notification Rule, the covered entity must notify HHS:

Accepted Answer

Within 60 days of the end of the calendar year in which the breach was discovered

Answer

Within 60 days of breach discovery

Answer

Within 30 days of breach discovery

Answer

Within 72 hours of breach discovery

Question 4

The HITECH Act enhanced HIPAA enforcement by:

Accepted Answer

Increasing civil monetary penalties and extending HIPAA obligations to business associates

Answer

Creating the Office of the National Coordinator for Health IT

Answer

Establishing the Medicare Access and CHIP Reauthorization Act

Answer

Mandating electronic health record adoption for all providers

Question 5

A data analytics team wants to use patient data for research without individual patient authorization. Which HIPAA pathway allows this if an IRB waives authorization requirements?

Accepted Answer

Research exception under 45 CFR §164.512(i)

Answer

Treatment operations exception

Answer

Public interest exception under §164.512(b)

Answer

De-identification safe harbor provision

Question 6

Under the CMS Promoting Interoperability Program, eligible hospitals that fail to demonstrate meaningful use of certified EHR technology face:

Accepted Answer

A payment adjustment (reduction) to their Medicare reimbursements

Answer

Exclusion from Medicaid programs

Answer

Civil monetary penalties up to $50,000

Answer

Mandatory audit by the Office of Inspector General

Question 7

Which standard framework specifically addresses electronic health information exchange security controls and is frequently referenced alongside HIPAA compliance programs?

Accepted Answer

NIST Cybersecurity Framework (CSF)

Answer

ISO 9001 Quality Management

Answer

SOC 2 Type II

Answer

PCI DSS