RHIT HIPAA Privacy and Security 5

Question 1

Which of the following scenarios represents a valid use of the HIPAA 'limited data set'?

Accepted Answer

Sharing data with a researcher under a data use agreement with 16 identifiers removed

Answer

A limited data set excludes most direct identifiers but may include dates and geographic data; it can be shared for research, public health, or healthcare operations under a data use agreement.

Question 2

Under the HITECH Act, which entities became directly liable for HIPAA compliance?

Accepted Answer

Business associates as well as covered entities

Answer

The HITECH Act extended direct HIPAA liability to business associates, meaning they are subject to HIPAA Security Rule requirements and civil and criminal penalties.

Question 3

A hospital posts a notice on its website and in patient areas about its privacy practices. This document is known as the:

Accepted Answer

Notice of Privacy Practices (NPP)

Answer

The Notice of Privacy Practices (NPP) informs patients how their PHI may be used and disclosed and outlines their rights under HIPAA.

Question 4

Which of the following is true regarding HIPAA and deceased individuals' PHI?

Accepted Answer

PHI of deceased individuals is protected for 50 years after death

Answer

HIPAA extends privacy protections to the PHI of deceased individuals for 50 years following their death.

Question 5

An HIM professional sends a fax containing PHI to the wrong recipient. Under HIPAA, this is considered:

Accepted Answer

A potential breach requiring a risk assessment

Answer

A misdirected fax is an impermissible disclosure that triggers the four-factor risk assessment to determine if it constitutes a reportable breach.

RHIT - Registered Health Information Technician Practice Test

RHIT - Registered Health Information Technician Practice Test

RHIT HIPAA Privacy and Security 5