CCT HIPAA Privacy and Security 2 — Questions and Answers
Question 1: Under HIPAA, which of the following is an example of a 'limited data set'?
- Patient name and SSN with diagnosis
- Dates of service and geographic data below state level with no direct identifiers (Correct answer)
- Full address and phone number
- All 18 identifiers with a data use agreement
Correct answer: Dates of service and geographic data below state level with no direct identifiers
A limited data set excludes direct identifiers but may include dates and geographic subdivisions below state level, and requires a data use agreement.
Question 2: Which HIPAA rule requires covered entities to implement policies protecting electronic protected health information (ePHI)?
- Privacy Rule
- Breach Notification Rule
- Security Rule (Correct answer)
- Enforcement Rule
Correct answer: Security Rule
The HIPAA Security Rule specifically governs the protection of ePHI through administrative, physical, and technical safeguards.
Question 3: A patient requests access to their medical records. Under HIPAA, the covered entity must provide access within how many days?
- 10 days
- 30 days (Correct answer)
- 60 days
- 90 days
Correct answer: 30 days
HIPAA requires covered entities to act on a patient's request for access to their PHI within 30 days, with one 30-day extension allowed.
Question 4: What is the maximum civil monetary penalty per violation category under HIPAA for 'reasonable cause' (not willful neglect)?
- $1,000
- $10,000 (Correct answer)
- $100,000
- $250,000
Correct answer: $10,000
HIPAA penalties for 'reasonable cause' (not willful neglect) range up to $10,000 per violation, up to $100,000 per calendar year.
Question 5: Which of the following is NOT a required element of a valid HIPAA authorization?
- Description of PHI to be used or disclosed
- Expiration date or event
- Signature of the covered entity's Privacy Officer (Correct answer)
- Statement that the individual may revoke the authorization
Correct answer: Signature of the covered entity's Privacy Officer
A valid HIPAA authorization requires the individual's (not the Privacy Officer's) signature, along with description of PHI, expiration, and revocation rights.
Question 6: Under the HIPAA Security Rule, an 'addressable' implementation specification means:
- It must be implemented exactly as written
- It is optional and may be skipped
- The covered entity must assess whether it is reasonable and appropriate, and document the decision (Correct answer)
- It applies only to large covered entities
Correct answer: The covered entity must assess whether it is reasonable and appropriate, and document the decision
Addressable specifications require covered entities to assess their applicability and either implement them, implement an alternative, or document why they are not reasonable and appropriate.
Question 7: Which entity type is primarily responsible for signing a Business Associate Agreement (BAA) with a covered entity?
- Any vendor providing office supplies
- An organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity (Correct answer)
- State health departments only
- Employees of the covered entity
Correct answer: An organization that creates, receives, maintains, or transmits PHI on behalf of a covered entity
A BAA is required with business associates — entities that perform functions involving PHI on behalf of a covered entity.
CCT HIPAA Privacy and Security 2
Under HIPAA, which of the following is an example of a 'limited data set'?