HIPAA Privacy & Security Rules Flashcards

Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Answer: De-identified health information with all 18 identifiers removed

De-identified health information that has had all 18 HIPAA identifiers removed is not considered PHI and is not protected under HIPAA.

A medical transcriptionist working remotely receives a dictation file via email without encryption. Which HIPAA rule is most directly violated?

Answer: Security Rule — transmission security safeguard

The HIPAA Security Rule requires transmission security safeguards, including encryption, when ePHI is transmitted over open networks like email.

What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect that is not corrected?

Answer: $100,000

The maximum civil monetary penalty for willful neglect not corrected is $100,000 per violation, with a $1.5 million annual cap per violation category.

Which of the following best describes a 'business associate' under HIPAA?

Answer: A vendor or contractor who performs functions involving PHI on behalf of a covered entity

A business associate is a person or entity that performs functions or activities on behalf of a covered entity involving the use or disclosure of PHI.

Under the HIPAA Minimum Necessary Standard, which scenario is compliant?

Answer: A transcriptionist accessing only the dictation file relevant to their current assignment

The Minimum Necessary Standard requires that access to PHI be limited to the amount reasonably needed to accomplish the intended purpose.

How long must covered entities retain HIPAA documentation, such as policies and procedures, after they are no longer in use?

Answer: 6 years

HIPAA requires covered entities to retain documentation for 6 years from the date of creation or the date it was last in effect, whichever is later.

A medical transcriptionist discovers they accidentally sent a patient's transcribed report to the wrong physician's office. What is the FIRST required action under HIPAA?

Answer: Report the incident to the covered entity or supervisor as a potential breach

The first required action is to report the incident internally so the covered entity can conduct a breach risk assessment under the Breach Notification Rule.