HIPAA Protected Health Information (PHI) 5

Question 1

Which of the following best describes 'incidental disclosures' of PHI under HIPAA?

Accepted Answer

Secondary disclosures that occur as a byproduct of permitted disclosures

Answer

Deliberate sharing of PHI with unauthorized parties

Answer

Accidental emailing of PHI to the wrong patient

Answer

Verbal disclosures made during emergency treatment

Question 2

A health plan is permitted to use PHI for underwriting purposes under HIPAA when:

Accepted Answer

Underwriting is a permitted healthcare operation for health plans

Answer

The patient provides written authorization

Answer

The plan is nonprofit and uses aggregate data only

Answer

It involves only prospective plan members

Question 3

Under HIPAA, a 'covered entity' includes all of the following EXCEPT:

Accepted Answer

Employers who sponsor self-insured health plans

Answer

Health plans

Answer

Healthcare clearinghouses

Answer

Healthcare providers who transmit health information electronically

Question 4

IP addresses are considered PHI under HIPAA when they:

Accepted Answer

Are linked or linkable to an individual's health information

Answer

Are collected from any website visitor

Answer

Come from devices used within a healthcare facility

Answer

Are stored in electronic health record systems

Question 5

A hospital uses patient data to conduct internal quality improvement studies. Under HIPAA, this activity is classified as:

Accepted Answer

A healthcare operation permitted without patient authorization

Answer

Research requiring IRB approval

Answer

A secondary use requiring patient consent

Answer

A limited data set requiring a data use agreement

Question 6

Which HIPAA provision allows a covered entity to disclose PHI to prevent a serious and imminent threat to the health or safety of a person or the public?

Accepted Answer

The serious threat exception

Answer

The healthcare operations exception

Answer

The law enforcement exception

Answer

The public interest exception

Question 7

A HIPAA violation is considered 'willful neglect' when the covered entity:

Accepted Answer

Consciously and intentionally fails to comply with HIPAA requirements

Answer

Accidentally sends PHI to the wrong fax number once

Answer

Fails to train a single new employee within the required timeframe

Answer

Discloses PHI during an emergency without proper documentation