CMRT Privacy & Security 2 — Questions and Answers
Question 1: Under HIPAA, which action constitutes a 'minimum necessary' violation?
- Accessing only the records needed for treatment
- Sharing a patient's entire medical history when only a lab result was requested (Correct answer)
- Providing a summary of care to a referring physician
- Disclosing the patient's name and appointment time to a scheduler
Correct answer: Sharing a patient's entire medical history when only a lab result was requested
The minimum necessary standard requires limiting PHI disclosures to only what is needed for the intended purpose.
Question 2: A covered entity's Notice of Privacy Practices (NPP) must be provided to patients:
- Only upon written request
- At first service delivery and posted in the facility (Correct answer)
- Annually regardless of new service
- Only when the privacy policy changes
Correct answer: At first service delivery and posted in the facility
HIPAA requires covered entities to provide the NPP at first contact or service and make it available at their facilities.
Question 3: Which scenario is an example of an 'incidental disclosure' that is permissible under HIPAA?
- Emailing PHI to the wrong recipient
- A patient overhearing their name called in a waiting room (Correct answer)
- Leaving a medical chart visible to the public at a nurses' station
- Faxing records to an unauthorized third party
Correct answer: A patient overhearing their name called in a waiting room
Incidental disclosures that occur as a byproduct of otherwise permissible communications, like calling a patient's name, are allowed if reasonable safeguards are in place.
Question 4: What is the purpose of a HIPAA Business Associate Agreement (BAA)?
- To authorize a patient to receive their own records
- To legally bind vendors who access PHI to comply with HIPAA safeguards (Correct answer)
- To document a covered entity's internal privacy policy
- To grant patients access to their designated record set
Correct answer: To legally bind vendors who access PHI to comply with HIPAA safeguards
A BAA is a contract requiring business associates who handle PHI on behalf of a covered entity to follow HIPAA requirements.
Question 5: Which of the following is NOT one of HIPAA's three categories of safeguards?
- Administrative
- Physical
- Technical
- Financial (Correct answer)
Correct answer: Financial
HIPAA's Security Rule specifies administrative, physical, and technical safeguards — financial is not a HIPAA safeguard category.
Question 6: A patient requests an amendment to their medical record. Under HIPAA, the covered entity may deny the request if:
- The record is more than five years old
- The record was not created by the covered entity (Correct answer)
- The patient disagrees with the treating provider's clinical judgment
- The amendment would increase the length of the record
Correct answer: The record was not created by the covered entity
A covered entity may deny an amendment request if the information was not created by that entity, among other permissible reasons.
Question 7: Which term describes the process of replacing PHI with a code or pseudonym while retaining a way to re-identify the data?
- De-identification
- Anonymization
- Pseudonymization (Correct answer)
- Aggregation
Correct answer: Pseudonymization
Pseudonymization replaces identifying information with a code, allowing re-identification by the holder of the key, unlike de-identification which removes all identifiers.
CMRT Privacy & Security 2
Under HIPAA, which action constitutes a 'minimum necessary' violation?