HIPAA The HIPAA Privacy Rule 2

Question 1

Which of the following is NOT considered Protected Health Information (PHI) under the HIPAA Privacy Rule?

Accepted Answer

De-identified health information with all 18 identifiers removed

Answer

A patient's diagnosis recorded in their medical chart

Answer

A patient's prescription history linked to their name

Answer

Health information transmitted electronically to an insurer

Question 2

Under the HIPAA Privacy Rule, what is the 'minimum necessary' standard?

Accepted Answer

Covered entities must limit PHI use and disclosure to the minimum needed to accomplish the intended purpose

Answer

Covered entities must use the least expensive method to protect PHI

Answer

Patients must receive the minimum amount of information about their own health records

Answer

Business associates must store only the minimum amount of PHI required by law

Question 3

A covered entity may disclose PHI without patient authorization for which of the following purposes?

Accepted Answer

Reporting a gunshot wound to law enforcement as required by state law

Answer

Marketing a new drug treatment to the patient

Answer

Selling PHI to a data analytics company

Answer

Sharing PHI with an employer for workplace wellness incentives

Question 4

How long must a covered entity retain its HIPAA Privacy Rule policies and documentation?

Accepted Answer

6 years from the date of creation or last effective date

Answer

3 years from the date of creation or last effective date

Answer

10 years from the date of creation or last effective date

Answer

Indefinitely, with no expiration

Question 5

Which individual within a covered entity is specifically required by the HIPAA Privacy Rule?

Accepted Answer

Privacy Officer

Answer

Chief Information Security Officer (CISO)

Answer

Compliance Attorney

Answer

HIPAA Auditor

Question 6

Under what circumstance may a covered entity deny a patient's request to access their own PHI?

Accepted Answer

A licensed healthcare professional determines access is likely to cause substantial harm to the patient

Answer

The patient owes an outstanding balance for services

Answer

The records are more than 5 years old

Answer

The patient requests records in electronic format

Question 7

What must a covered entity include in its Notice of Privacy Practices (NPP)?

Accepted Answer

A description of the types of uses and disclosures the covered entity may make of PHI

Answer

The names of all employees who have accessed patient records

Answer

A complete list of all business associates

Answer

The specific fees charged for releasing medical records