AHIMA HIPAA Privacy and Security 1 — Questions and Answers
Question 1: What is HIPAA?
- The Health Insurance Portability and Accountability Act — federal law protecting patient health information privacy (Correct answer)
- A type of health insurance
- A medical procedure
- A coding system
Correct answer: The Health Insurance Portability and Accountability Act — federal law protecting patient health information privacy
HIPAA establishes national standards for protecting sensitive patient health information from being disclosed without consent.
Question 2: What is Protected Health Information (PHI)?
- Any individually identifiable health information including demographics, diagnoses, and treatment records (Correct answer)
- Only a patient's name
- Only insurance information
- Only billing records
Correct answer: Any individually identifiable health information including demographics, diagnoses, and treatment records
PHI includes any information that can identify an individual and relates to their health condition, care, or payment, in any form (paper, electronic, oral).
Question 3: What is the minimum necessary standard?
- Access to PHI should be limited to the minimum amount needed to accomplish the intended purpose (Correct answer)
- All staff can access all records
- PHI should be shared freely
- The standard only applies to billing
Correct answer: Access to PHI should be limited to the minimum amount needed to accomplish the intended purpose
The minimum necessary principle requires that access to and disclosure of PHI be limited to what is reasonably necessary for the specific purpose.
Question 4: What are the penalties for HIPAA violations?
- Civil fines from $100 to $50,000 per violation, criminal penalties up to $250,000 and imprisonment (Correct answer)
- A verbal warning only
- No penalties exist
- Only a small fine
Correct answer: Civil fines from $100 to $50,000 per violation, criminal penalties up to $250,000 and imprisonment
HIPAA penalties range from civil monetary penalties to criminal prosecution with imprisonment, depending on the nature and severity of the violation.
Question 5: What is a Business Associate Agreement (BAA)?
- A contract between a covered entity and a vendor that ensures PHI protection when shared (Correct answer)
- A partnership between hospitals
- An insurance agreement
- A patient consent form
Correct answer: A contract between a covered entity and a vendor that ensures PHI protection when shared
BAAs legally require business associates (vendors handling PHI) to implement appropriate safeguards and comply with HIPAA regulations.
Question 6: What is a HIPAA breach notification?
- Required notification to affected individuals and HHS when unsecured PHI is improperly accessed or disclosed (Correct answer)
- An optional courtesy notification
- A system error report
- A patient complaint form
Correct answer: Required notification to affected individuals and HHS when unsecured PHI is improperly accessed or disclosed
Breach notification rules require covered entities to notify affected individuals, HHS, and sometimes media when a breach of unsecured PHI occurs.
AHIMA HIPAA Privacy and Security 1
What is HIPAA?