HIPAA The Omnibus Rule 2

Question 1

Under the Omnibus Rule, which of the following best describes a 'subcontractor' of a business associate?

Accepted Answer

A person or entity that creates, receives, maintains, or transmits PHI on behalf of a business associate

Answer

A covered entity that shares PHI with a vendor

Answer

An employee of a covered entity who accesses PHI

Answer

A government agency that oversees HIPAA compliance

Question 2

The Omnibus Rule changed the definition of 'marketing' under HIPAA. Which of the following is NOT considered marketing under the revised definition?

Accepted Answer

Communications about treatment alternatives for the individual

Answer

Sending promotional materials for a third-party product without authorization

Answer

Subsidized communications about a health-related product where the covered entity receives remuneration

Answer

Targeted advertisements based on an individual's health status

Question 3

Under the Omnibus Rule, when a business associate agreement (BAA) is in place and a subcontractor breaches it, who bears direct liability to HHS?

Accepted Answer

Both the business associate and the subcontractor

Answer

Only the covered entity

Answer

Only the business associate

Answer

Only the subcontractor

Question 4

Which of the following correctly describes the Omnibus Rule's approach to the minimum necessary standard for uses and disclosures?

Accepted Answer

Covered entities must make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose

Answer

Covered entities may use or disclose all PHI in a record if any portion is needed

Answer

The minimum necessary standard applies only to disclosures to third parties, not internal uses

Answer

Business associates are exempt from the minimum necessary standard

Question 5

Under the Omnibus Rule, what is the maximum penalty per violation category per calendar year?

Accepted Answer

$1,500,000

Answer

$10,000

Answer

$100,000

Answer

$1,000,000

Question 6

The Omnibus Rule modified the Breach Notification Rule by changing the standard for what constitutes a breach. What is the new presumption?

Accepted Answer

Any impermissible use or disclosure is presumed to be a breach unless the covered entity proves low probability of compromise

Answer

A breach is only confirmed if PHI is actually viewed by an unauthorized person

Answer

Breaches only require notification when more than 500 individuals are affected

Answer

A covered entity's self-assessment that no harm occurred is sufficient to rebut a breach

Question 7

Under the Omnibus Rule, individuals have a right to request restrictions on disclosures of PHI to health plans when the individual pays out-of-pocket in full. What must a covered entity do in this situation?

Accepted Answer

Comply with the restriction request if it relates to the specific item or service paid for out-of-pocket

Answer

Notify the health plan within 30 days and then restrict the disclosure

Answer

Deny the request if the health plan requires the information for claims processing

Answer

Restrict the disclosure only if approved by the covered entity's privacy officer