HIPAA Compliance 4

Question 1

Which of the following HIPAA Security Rule safeguards requires covered entities to implement automatic logoff on workstations?

Accepted Answer

Technical safeguards — automatic logoff

Answer

Automatic logoff is an addressable implementation specification under the Technical Safeguards section of the HIPAA Security Rule (45 CFR § 164.312).

Question 2

What does the HIPAA 'Safe Harbor' de-identification method require?

Accepted Answer

Removal of 17 specific categories of identifiers and no actual knowledge of re-identification

Answer

The Safe Harbor method requires removing all 18 categories of specified identifiers (one category covers geographic data down to three-digit ZIP codes) and that the covered entity has no actual knowledge that the remaining information could re-identify an individual.

Question 3

A subcontractor of a business associate handles ePHI as part of its work. Under HIPAA, the subcontractor is:

Accepted Answer

Considered a business associate and must comply with the Security Rule directly

Answer

The HITECH Act extended direct HIPAA liability to subcontractors of business associates; they are treated as business associates and must comply with applicable HIPAA Rules.

Question 4

A patient requests access to their PHI in an electronic format. If the covered entity maintains the records electronically, it must:

Accepted Answer

Provide the records in the electronic format requested by the individual if readily producible

Answer

Under HIPAA and HITECH, if a covered entity maintains PHI electronically, it must provide that PHI in the electronic format requested by the individual if it is readily producible in that format.

Question 5

Which of the following is NOT a permissible disclosure of PHI without individual authorization under the HIPAA Privacy Rule?

Accepted Answer

Disclosure to a marketing firm for a drug manufacturer's campaign

Answer

HIPAA does not permit disclosure of PHI to marketing firms for commercial purposes without individual authorization; the other listed disclosures are recognized exceptions.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Compliance 4