RHIT - Registered Health Information Technician HIPAA Privacy and Security Questions and Answers

Question 1

A hospital discovers that an unencrypted laptop containing the protected health information (PHI) of 600 patients was stolen.
After a risk assessment, it is determined there is a significant risk of harm to the individuals.
According to the HIPAA Breach Notification Rule, which of the following actions is required?

Accepted Answer

Notify the affected individuals without unreasonable delay, notify the Secretary of HHS, and notify prominent media outlets.

Answer

Notify the Secretary of HHS annually and publish a notice in a local newspaper.

Answer

Notify only the affected individuals within 90 days of discovering the breach.

Answer

Report the theft to local law enforcement and wait for their investigation to conclude before taking further action.

Question 2

A health information technician is creating a new user account for a recently hired coder. The technician grants the coder access to view patient records, assign codes, and query physicians, but restricts access to financial and billing systems. This practice is an example of which HIPAA Security Rule concept?

Accepted Answer

Role-based access control (RBAC)

Answer

Contingency planning

Answer

Risk analysis

Answer

Encryption

Question 3

A patient submits a formal written request for a copy of their medical records on March 1st. Under the HIPAA Privacy Rule's right of access, what is the latest date by which the covered entity must provide the records or a written explanation for a delay?

Accepted Answer

March 31st

Answer

March 15th

Answer

April 15th

Answer

April 30th

Question 4

Which of the following activities is considered a healthcare 'operation' under HIPAA, allowing for the use and disclosure of PHI without patient authorization?

Accepted Answer

Conducting internal quality assessment and improvement activities

Answer

Providing a patient's immunization history to a school

Answer

Disclosing PHI to a pharmaceutical company for marketing purposes

Answer

Submitting PHI to a life insurance company for underwriting

Question 5

Which of the following is an example of a TECHNICAL safeguard required by the HIPAA Security Rule?

Accepted Answer

Using unique user IDs and automatic log-off procedures for computer systems.

Answer

Developing a security awareness and training program for staff.

Answer

Implementing policies and procedures for workstation use.

Answer

Positioning computer monitors to prevent casual viewing by the public.

Question 6

A patient is in the emergency room and is unable to communicate. Their spouse calls the hospital asking for an update. According to the HIPAA Privacy Rule, what is the most appropriate action for the healthcare provider to take?

Accepted Answer

Share limited information directly relevant to the spouse's involvement in the patient's care using professional judgment.

Answer

Refuse to provide any information due to a lack of written authorization.

Answer

Provide a complete and detailed summary of the patient's condition and test results.

Answer

Inform the spouse that they must obtain a court order to receive any information.