RHIT HIPAA Privacy and Security 4

Question 1

Under HIPAA, which of the following is a 'hybrid entity'?

Accepted Answer

An organization that is only partially a covered entity but performs both covered and non-covered functions

Answer

A hybrid entity is an organization whose covered functions are not its primary business, allowing it to designate specific healthcare components as subject to HIPAA.

Question 2

What is the maximum civil monetary penalty per violation category under HIPAA if the covered entity did not know of the violation?

Accepted Answer

$100 per violation, up to $25,000 annually

Answer

For violations where the entity did not know and could not have known, the penalty is $100–$50,000 per violation, with a $25,000 annual cap for identical violations.

Question 3

Which safeguard category under the HIPAA Security Rule includes unique user identification and automatic logoff?

Accepted Answer

Technical safeguards

Answer

Technical safeguards include access controls such as unique user IDs, automatic logoff, and encryption mechanisms to protect ePHI.

Question 4

A covered entity discovers a potential breach. The HIPAA breach notification rule presumes that an impermissible use or disclosure is a breach unless:

Accepted Answer

A low probability assessment shows the PHI was not compromised

Answer

The covered entity can rebut the presumption of breach by demonstrating through a four-factor risk assessment that there is a low probability the PHI was compromised.

Question 5

Which of the following must be included in an accounting of disclosures provided to a patient?

Accepted Answer

Disclosures made without authorization for purposes other than TPO

Answer

Accounting of disclosures covers disclosures made without authorization, excluding those for treatment, payment, and operations.

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Practice Test

RHIT HIPAA Privacy and Security 4