Compliance Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Compliance flashcards as text
What is the maximum civil monetary penalty per violation category for 'willful neglect — not corrected' under HIPAA?
Answer: $100,000 per violation, up to $1,500,000 annually
For willful neglect that is not corrected, HIPAA penalties can reach $100,000 per violation with an annual cap of $1,500,000 for identical violations.
A covered entity is performing a risk analysis. Which regulation mandates this activity?
Answer: The HIPAA Security Rule
The HIPAA Security Rule (45 CFR § 164.308) explicitly requires covered entities to conduct an accurate and thorough assessment of risks to ePHI confidentiality, integrity, and availability.
An individual requests an amendment to their PHI in a designated record set. Within how many days must the covered entity act on the request?
Answer: 60 days, with one 30-day extension
Covered entities must act on an amendment request within 60 days of receipt, with a single 30-day extension if proper written notice is given.
Which of the following best describes 'treatment, payment, and health care operations' (TPO) under HIPAA?
Answer: Permissible uses and disclosures of PHI that generally do not require authorization
HIPAA permits covered entities to use and disclose PHI for treatment, payment, and health care operations without individual authorization as these are essential health care functions.
A covered entity discovers a breach of unsecured PHI affecting 600 individuals. Who must be notified, and by when?
Answer: Individuals within 60 days, and HHS within 60 days, and prominent media within 60 days
For breaches affecting 500+ residents of a state or jurisdiction, covered entities must notify individuals, HHS, and prominent local media within 60 days of discovery.
Under the HIPAA Privacy Rule, psychotherapy notes receive special protection because they:
Answer: Require separate authorization for most disclosures, even from the rest of the medical record
Psychotherapy notes are specially protected under HIPAA and generally require separate, specific authorization for disclosure, even when other PHI from the same record could be disclosed without authorization.
A workforce member who is a victim of domestic violence may receive which special HIPAA accommodation regarding their PHI?
Answer: They may request that communications be sent to an alternative address or by alternative means
HIPAA's Privacy Rule gives individuals the right to request confidential communications, such as receiving appointment reminders at an alternate address, which providers must accommodate if reasonable.