RHIT HIPAA Privacy and Security 4

Question 1

Under HIPAA, which of the following is a 'hybrid entity'?

Accepted Answer

An organization that is only partially a covered entity but performs both covered and non-covered functions

Answer

A covered entity with operations in multiple states

Answer

A business associate that also acts as a covered entity

Answer

An entity that uses both paper and electronic records

Question 2

What is the maximum civil monetary penalty per violation category under HIPAA if the covered entity did not know of the violation?

Accepted Answer

$100 per violation, up to $25,000 annually

Answer

$1,000 per violation, up to $100,000 annually

Answer

$10,000 per violation, up to $250,000 annually

Answer

$50,000 per violation, up to $1.5 million annually

Question 3

Which safeguard category under the HIPAA Security Rule includes unique user identification and automatic logoff?

Accepted Answer

Technical safeguards

Answer

Administrative safeguards

Answer

Physical safeguards

Answer

Organizational safeguards

Question 4

A covered entity discovers a potential breach. The HIPAA breach notification rule presumes that an impermissible use or disclosure is a breach unless:

Accepted Answer

A low probability assessment shows the PHI was not compromised

Answer

The covered entity reports it to HHS within 24 hours

Answer

The patient was notified within 10 days

Answer

The data was encrypted at rest

Question 5

Which of the following must be included in an accounting of disclosures provided to a patient?

Accepted Answer

Disclosures made without authorization for purposes other than TPO

Answer

All disclosures for treatment, payment, and operations

Answer

Disclosures for which the patient signed an authorization

Answer

Internal uses of PHI by healthcare staff

Question 6

A covered entity receives a subpoena for a patient's medical records. Under HIPAA, the covered entity may disclose the records if:

Accepted Answer

Satisfactory assurances are provided that the patient was notified or a protective order is in place

Answer

Any attorney requests them

Answer

The court case is pending for more than 6 months

Answer

The covered entity's legal counsel approves

Question 7

Which of the following best describes 'addressable' implementation specifications under the HIPAA Security Rule?

Accepted Answer

They must be implemented if reasonable and appropriate, or an equivalent alternative used

Answer

They are optional and need not be implemented

Answer

They must be implemented exactly as written

Answer

They apply only to large covered entities