HIPAA Protected Health Information (PHI) 2

Question 1

Which of the following is NOT considered one of the 18 HIPAA identifiers that make health information PHI?

Accepted Answer

Blood type alone

Answer

Blood type alone is not one of the 18 identifiers listed under HIPAA; it only becomes PHI when combined with an identifier that links it to a specific individual.

Question 2

A hospital shares a patient's treatment records with a business associate for billing purposes. Under HIPAA, this disclosure is:

Accepted Answer

Permitted as part of Treatment, Payment, or Operations (TPO)

Answer

HIPAA permits covered entities to disclose PHI to business associates for Treatment, Payment, and Healthcare Operations (TPO) without additional patient authorization.

Question 3

Under HIPAA, 'de-identification' of PHI can be achieved through which two accepted methods?

Accepted Answer

Expert determination and safe harbor

Answer

HIPAA recognizes two official de-identification methods: Expert Determination (statistical verification of re-identification risk) and the Safe Harbor method (removal of all 18 identifiers).

Question 4

A patient's name combined with their appointment date at a mental health clinic is considered PHI because:

Accepted Answer

It links an identifier to information that reveals health status or treatment

Answer

PHI is created when an identifier (like a name) is combined with information that relates to a person's health condition, treatment, or payment for healthcare.

Question 5

Which entity is primarily responsible for enforcing HIPAA's Privacy Rule?

Accepted Answer

The Office for Civil Rights (OCR) within HHS

Answer

The Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) is the primary enforcement agency for HIPAA's Privacy and Security Rules.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Protected Health Information (PHI) 2