CCT - Certified Compliance Technician HIPAA Privacy and Security Questions and Answers

Question 1

A hospital's billing department is preparing to send a patient's invoice to a third-party collection agency. According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following Protected Health Information (PHI) is most appropriate for the hospital to disclose?

Accepted Answer

Patient's name, address, dates of service, and the total outstanding balance.

Answer

The HIPAA 'minimum necessary' standard requires covered entities to make reasonable efforts to limit the use and disclosure of PHI to the minimum necessary to accomplish the intended purpose. For a collection agency, the purpose is to collect a debt. This requires demographic information to identify and contact the patient and the specific amount owed from the dates of service, but not detailed clinical information like diagnoses or the entire medical record.

Question 2

A small medical clinic is implementing its HIPAA Security Rule compliance plan. When addressing the implementation specifications for its administrative safeguards, what is the key difference between 'required' and 'addressable' specifications?

Accepted Answer

Addressable specifications must be assessed; if not implemented, the decision and rationale must be documented.

Answer

Under the HIPAA Security Rule, 'addressable' does not mean optional. A covered entity must assess whether an addressable specification is a reasonable and appropriate safeguard in its environment. If it is not, the entity must document why and may implement an equivalent alternative measure if reasonable and appropriate. Required specifications must be implemented as the rule states.

Question 3

A business associate discovers a breach of unsecured PHI affecting 450 individuals of a covered entity on March 1st. What is the latest date by which the business associate must notify the covered entity?

Accepted Answer

Without unreasonable delay, and in no case later than 60 days following discovery.

Answer

The HIPAA Breach Notification Rule requires a business associate to notify the covered entity of a breach 'without unreasonable delay and in no case later than 60 days' from the discovery of the breach. This allows the covered entity to then fulfill its own notification duties to the affected individuals and HHS.

Question 4

Which of the following is an example of a HIPAA Security Rule 'technical safeguard'?

Accepted Answer

Using encryption to render electronic protected health information (ePHI) unreadable.

Answer

The HIPAA Security Rule's technical safeguards involve the technology used to protect ePHI and control access to it. Encryption is a specific example of a technical safeguard that renders ePHI unusable, unreadable, or indecipherable to unauthorized individuals. A security incident response plan and training are administrative safeguards, while monitor positioning is a physical safeguard.

Question 5

A patient submits a written request to their healthcare provider for a copy of their medical records. Under the HIPAA Privacy Rule, the provider must generally provide access to the records within what timeframe?

Accepted Answer

30 calendar days

Answer

The HIPAA Privacy Rule gives individuals the right to access and receive a copy of their PHI. A covered entity must act on the request within 30 days of receipt. If necessary, the entity can extend the time for no more than 30 additional days, provided they inform the individual in writing of the reasons for the delay.

(CCT) Certified Compliance Technician Practice Test

(CCT) Certified Compliance Technician Practice Test

CCT - Certified Compliance Technician HIPAA Privacy and Security Questions and Answers