MT HIPAA Privacy & Security Rules 2 — Questions and Answers
Question 1: Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?
- A patient's diagnosis documented in a medical record
- De-identified health information with all 18 identifiers removed (Correct answer)
- A patient's date of birth combined with their condition
- A patient's name linked to their treatment history
Correct answer: De-identified health information with all 18 identifiers removed
De-identified health information that has had all 18 HIPAA identifiers removed is not considered PHI and is not protected under HIPAA.
Question 2: A medical transcriptionist working remotely receives a dictation file via email without encryption. Which HIPAA rule is most directly violated?
- Privacy Rule — minimum necessary standard
- Security Rule — transmission security safeguard (Correct answer)
- Breach Notification Rule — timeliness requirement
- Privacy Rule — notice of privacy practices
Correct answer: Security Rule — transmission security safeguard
The HIPAA Security Rule requires transmission security safeguards, including encryption, when ePHI is transmitted over open networks like email.
Question 3: What is the maximum civil monetary penalty per violation category under HIPAA for willful neglect that is not corrected?
- $10,000
- $50,000
- $100,000 (Correct answer)
- $250,000
Correct answer: $100,000
The maximum civil monetary penalty for willful neglect not corrected is $100,000 per violation, with a $1.5 million annual cap per violation category.
Question 4: Which of the following best describes a 'business associate' under HIPAA?
- Any employee of a covered entity who handles PHI
- A vendor or contractor who performs functions involving PHI on behalf of a covered entity (Correct answer)
- A patient's authorized representative who accesses medical records
- A government agency that receives PHI for public health activities
Correct answer: A vendor or contractor who performs functions involving PHI on behalf of a covered entity
A business associate is a person or entity that performs functions or activities on behalf of a covered entity involving the use or disclosure of PHI.
Question 5: Under the HIPAA Minimum Necessary Standard, which scenario is compliant?
- Sharing an entire patient chart with a billing clerk who only needs the diagnosis codes
- A transcriptionist accessing only the dictation file relevant to their current assignment (Correct answer)
- Sending a complete medical history to a receptionist scheduling a follow-up appointment
- Allowing all staff to view any patient record for general reference purposes
Correct answer: A transcriptionist accessing only the dictation file relevant to their current assignment
The Minimum Necessary Standard requires that access to PHI be limited to the amount reasonably needed to accomplish the intended purpose.
Question 6: How long must covered entities retain HIPAA documentation, such as policies and procedures, after they are no longer in use?
- 3 years
- 5 years
- 6 years (Correct answer)
- 10 years
Correct answer: 6 years
HIPAA requires covered entities to retain documentation for 6 years from the date of creation or the date it was last in effect, whichever is later.
Question 7: A medical transcriptionist discovers they accidentally sent a patient's transcribed report to the wrong physician's office. What is the FIRST required action under HIPAA?
- Immediately notify the patient by certified mail
- Report the incident to the covered entity or supervisor as a potential breach (Correct answer)
- Delete the email and hope it was not read
- File a complaint with the Office for Civil Rights
Correct answer: Report the incident to the covered entity or supervisor as a potential breach
The first required action is to report the incident internally so the covered entity can conduct a breach risk assessment under the Breach Notification Rule.
MT HIPAA Privacy & Security Rules 2
Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?