RHIT HIPAA Privacy and Security 3

Question 1

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach within:

Accepted Answer

60 days of discovery

Answer

Covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach.

Question 2

A healthcare worker accesses a colleague's medical record out of curiosity without any treatment purpose. This is a violation of which HIPAA concept?

Accepted Answer

Minimum necessary standard

Answer

Accessing records without a job-related need violates the minimum necessary standard, which prohibits accessing more PHI than required for one's role.

Question 3

Which of the following is a required implementation specification under the HIPAA Security Rule's administrative safeguards?

Accepted Answer

Security management process

Answer

Security management process is a required administrative safeguard that includes conducting risk analyses and implementing risk management procedures.

Question 4

A patient asks a covered entity to restrict disclosure of PHI to their health plan for services paid out-of-pocket. The covered entity must:

Accepted Answer

Comply with the restriction

Answer

Under the HITECH Act amendment to HIPAA, covered entities must honor a patient's request to restrict disclosure to a health plan when the patient has paid out-of-pocket in full.

Question 5

Which HIPAA provision allows patients to request corrections to their medical records?

Accepted Answer

Right to amend

Answer

The right to amend allows patients to request corrections to inaccurate or incomplete PHI in a covered entity's designated record set.

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Practice Test

RHIT HIPAA Privacy and Security 3