HIPAA Healthcare Provider Obligations and Covered Entities

Question 1

Under HIPAA, which of the following is a 'covered entity'?

Accepted Answer

A healthcare clearinghouse that processes health insurance claims electronically

Answer

A software company that builds EHR systems

Answer

A law firm advising a hospital on HIPAA compliance

Answer

A patient advocacy organization that does not handle billing

Question 2

A small cash-only family physician practice that has never transmitted any health information electronically is subject to HIPAA under which condition?

Accepted Answer

The practice becomes covered if it submits even a single electronic claim or electronic transaction covered by HIPAA standards

Answer

Small cash-only practices are entirely exempt from HIPAA

Answer

HIPAA applies only to practices with more than 10 employees

Answer

Cash-only practices are covered entities from the day they open regardless of electronic transactions

Question 3

Which of the following healthcare entities is NOT typically a covered entity under HIPAA?

Accepted Answer

A workers' compensation insurer

Answer

An individual physician in private practice who submits claims electronically

Answer

A hospital emergency department

Answer

A Medicare Advantage plan

Question 4

Under HIPAA, what is a 'hybrid entity'?

Accepted Answer

An organization that performs both covered and non-covered healthcare functions within the same legal entity

Answer

An organization that serves both as a covered entity and a business associate simultaneously

Answer

A for-profit organization that also operates a non-profit health clinic

Answer

An entity with locations in multiple states with different HIPAA obligations

Question 5

What is the primary HIPAA obligation when a healthcare provider refers a patient to a specialist?

Accepted Answer

The provider may share the minimum necessary PHI for treatment purposes without patient authorization

Answer

The provider must obtain written patient authorization before sending any information to the specialist

Answer

The patient's insurance must be notified before any referral PHI is shared

Answer

Referral PHI can only be shared by fax, never electronically

Question 6

A hospital employed physician has PHI access as part of her clinical role. The same physician's practice is also employed in a non-clinical administrative role at the hospital. Under HIPAA, when she accesses PHI for administrative purposes, what standard applies?

Accepted Answer

Access for administrative purposes must be limited to the minimum necessary for the administrative function

Answer

No restrictions apply since she is a workforce member of the covered entity

Answer

Administrative access to PHI is prohibited under HIPAA

Answer

PHI may only be accessed by clinical staff, not administrative staff

Question 7

Under HIPAA, what is an 'affiliated covered entity'?

Accepted Answer

Two or more legally separate covered entities under common ownership that may designate themselves as a single covered entity for HIPAA purposes

Answer

A covered entity with branches in multiple states

Answer

Any covered entity that has executed BAAs with business associates

Answer

A covered entity that has undergone HHS-approved merger

Question 8

Which of the following represents a covered entity's obligation under HIPAA when receiving a request for PHI from law enforcement?

Accepted Answer

Covered entities may only disclose PHI to law enforcement under specific circumstances without authorization and should disclose only what is required

Answer

Covered entities must provide all requested PHI to law enforcement immediately

Answer

Law enforcement requests always require patient authorization before disclosure

Answer

Police requests for PHI can be denied entirely without any legal consequences

Question 9

A covered entity's employee discovers that a family member is a patient at their organization. Under HIPAA, what is the employee's obligation?

Accepted Answer

The employee must not access the family member's records unless they are directly involved in that person's care

Answer

The employee may access the family member's records as a courtesy

Answer

Only immediate family members' records can be accessed; extended family requires authorization

Answer

The employee must inform the family member that their records are accessible

Question 10

Under HIPAA, what must a covered entity provide to patients at first service delivery?

Accepted Answer

A Notice of Privacy Practices describing how the covered entity uses and discloses PHI

Answer

A copy of the entire HIPAA Privacy Rule

Answer

Written authorization forms for all potential future uses of their PHI

Answer

A list of all workforce members with access to their PHI