HIPAA Protected Health Information (PHI) 2

Question 1

Which of the following is NOT considered one of the 18 HIPAA identifiers that make health information PHI?

Accepted Answer

Blood type alone

Answer

Social Security numbers

Answer

Account numbers

Answer

Device identifiers and serial numbers

Question 2

A hospital shares a patient's treatment records with a business associate for billing purposes. Under HIPAA, this disclosure is:

Accepted Answer

Permitted as part of Treatment, Payment, or Operations (TPO)

Answer

Prohibited without explicit written patient consent

Answer

Allowed only if the patient is deceased

Answer

Requires a court order

Question 3

Under HIPAA, 'de-identification' of PHI can be achieved through which two accepted methods?

Accepted Answer

Expert determination and safe harbor

Answer

Encryption and tokenization

Answer

Anonymization and pseudonymization

Answer

Redaction and aggregation

Question 4

A patient's name combined with their appointment date at a mental health clinic is considered PHI because:

Accepted Answer

It links an identifier to information that reveals health status or treatment

Answer

Appointment dates are always PHI regardless of context

Answer

Mental health information has special protections under HIPAA

Answer

Names are always PHI regardless of context

Question 5

Which entity is primarily responsible for enforcing HIPAA's Privacy Rule?

Accepted Answer

The Office for Civil Rights (OCR) within HHS

Answer

The Federal Trade Commission (FTC)

Answer

The Department of Justice (DOJ)

Answer

The Centers for Medicare & Medicaid Services (CMS)

Question 6

A researcher wants to use patient data without obtaining individual authorizations. Under HIPAA, this is permissible if:

Accepted Answer

An Institutional Review Board (IRB) waives the authorization requirement

Answer

The research is funded by a federal agency

Answer

The patients are not currently receiving treatment

Answer

The data involves fewer than 500 patients

Question 7

What is the HIPAA 'minimum necessary' standard as it applies to PHI?

Accepted Answer

Only the minimum amount of PHI needed to accomplish a purpose should be used or disclosed

Answer

Covered entities must use the fewest employees possible to handle PHI

Answer

PHI must be stored in the smallest possible database

Answer

Patients must provide only minimum information for treatment