HIPAA Protected Health Information (PHI) 2 — Questions and Answers
Question 1: Which of the following is NOT considered one of the 18 HIPAA identifiers that make health information PHI?
- Social Security numbers
- Account numbers
- Blood type alone (Correct answer)
- Device identifiers and serial numbers
Correct answer: Blood type alone
Blood type alone is not one of the 18 identifiers listed under HIPAA; it only becomes PHI when combined with an identifier that links it to a specific individual.
Question 2: A hospital shares a patient's treatment records with a business associate for billing purposes. Under HIPAA, this disclosure is:
- Prohibited without explicit written patient consent
- Permitted as part of Treatment, Payment, or Operations (TPO) (Correct answer)
- Allowed only if the patient is deceased
- Requires a court order
Correct answer: Permitted as part of Treatment, Payment, or Operations (TPO)
HIPAA permits covered entities to disclose PHI to business associates for Treatment, Payment, and Healthcare Operations (TPO) without additional patient authorization.
Question 3: Under HIPAA, 'de-identification' of PHI can be achieved through which two accepted methods?
- Encryption and tokenization
- Expert determination and safe harbor (Correct answer)
- Anonymization and pseudonymization
- Redaction and aggregation
Correct answer: Expert determination and safe harbor
HIPAA recognizes two official de-identification methods: Expert Determination (statistical verification of re-identification risk) and the Safe Harbor method (removal of all 18 identifiers).
Question 4: A patient's name combined with their appointment date at a mental health clinic is considered PHI because:
- Appointment dates are always PHI regardless of context
- It links an identifier to information that reveals health status or treatment (Correct answer)
- Mental health information has special protections under HIPAA
- Names are always PHI regardless of context
Correct answer: It links an identifier to information that reveals health status or treatment
PHI is created when an identifier (like a name) is combined with information that relates to a person's health condition, treatment, or payment for healthcare.
Question 5: Which entity is primarily responsible for enforcing HIPAA's Privacy Rule?
- The Federal Trade Commission (FTC)
- The Department of Justice (DOJ)
- The Office for Civil Rights (OCR) within HHS (Correct answer)
- The Centers for Medicare & Medicaid Services (CMS)
Correct answer: The Office for Civil Rights (OCR) within HHS
The Office for Civil Rights (OCR) within the Department of Health and Human Services (HHS) is the primary enforcement agency for HIPAA's Privacy and Security Rules.
Question 6: A researcher wants to use patient data without obtaining individual authorizations. Under HIPAA, this is permissible if:
- The research is funded by a federal agency
- An Institutional Review Board (IRB) waives the authorization requirement (Correct answer)
- The patients are not currently receiving treatment
- The data involves fewer than 500 patients
Correct answer: An Institutional Review Board (IRB) waives the authorization requirement
HIPAA allows use of PHI for research without individual authorization when an IRB or Privacy Board grants a waiver based on criteria protecting patients' privacy interests.
Question 7: What is the HIPAA 'minimum necessary' standard as it applies to PHI?
- Covered entities must use the fewest employees possible to handle PHI
- Only the minimum amount of PHI needed to accomplish a purpose should be used or disclosed (Correct answer)
- PHI must be stored in the smallest possible database
- Patients must provide only minimum information for treatment
Correct answer: Only the minimum amount of PHI needed to accomplish a purpose should be used or disclosed
The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI use, disclosure, and requests to the least amount needed to accomplish the intended purpose.
HIPAA Protected Health Information (PHI) 2
Which of the following is NOT considered one of the 18 HIPAA identifiers that make health information PHI?