RHIA Compliance, Privacy, and Security 1 — Questions and Answers
Question 1: Under HIPAA, which rule specifically governs the security of electronic protected health information (ePHI)?
- HIPAA Privacy Rule
- HIPAA Security Rule (Correct answer)
- HIPAA Enforcement Rule
- HIPAA Breach Notification Rule
Correct answer: HIPAA Security Rule
The HIPAA Security Rule establishes national standards for protecting ePHI through administrative, physical, and technical safeguards.
Question 2: What is the minimum necessary standard under the HIPAA Privacy Rule?
- Providers must maintain the minimum number of health records
- Covered entities must disclose only the minimum PHI needed to accomplish the intended purpose (Correct answer)
- Patients must be notified of the minimum rights they have
- Facilities must implement the minimum required security controls
Correct answer: Covered entities must disclose only the minimum PHI needed to accomplish the intended purpose
The minimum necessary standard requires covered entities to limit PHI use and disclosure to only what is needed to accomplish the purpose of the use or disclosure.
Question 3: Who is considered a 'covered entity' under HIPAA?
- Any company that employs healthcare workers
- Health plans, healthcare clearinghouses, and healthcare providers that transmit PHI electronically (Correct answer)
- All US businesses with more than 50 employees
- Only federal government health agencies
Correct answer: Health plans, healthcare clearinghouses, and healthcare providers that transmit PHI electronically
HIPAA covered entities include health plans, healthcare clearinghouses, and healthcare providers (hospitals, physicians, etc.) that transmit PHI electronically for covered transactions.
Question 4: Under the HIPAA Privacy Rule, which of the following does NOT require patient authorization for disclosure?
- Disclosure to a marketing firm
- Disclosure for treatment, payment, or healthcare operations (TPO) (Correct answer)
- Disclosure to a researcher without a waiver
- Disclosure of psychotherapy notes
Correct answer: Disclosure for treatment, payment, or healthcare operations (TPO)
The HIPAA Privacy Rule permits disclosure of PHI without patient authorization for treatment, payment, and healthcare operations (TPO) activities.
Question 5: What must a covered entity do when a breach of unsecured PHI affects 500 or more individuals in a state?
- Notify HHS only within 60 days
- Notify affected individuals, HHS, and prominent media outlets in the affected state within 60 days (Correct answer)
- Notify only the affected individuals within 30 days
- File a police report and notify HHS annually
Correct answer: Notify affected individuals, HHS, and prominent media outlets in the affected state within 60 days
For breaches affecting 500 or more individuals in a state, covered entities must notify affected individuals, HHS, and prominent media outlets in that state within 60 days of discovery.
Question 6: What is a business associate agreement (BAA) under HIPAA?
- A contract requiring vendors to use only approved EHR software
- A written contract requiring business associates to appropriately safeguard PHI they access on behalf of a covered entity (Correct answer)
- An employment agreement for HIM staff handling PHI
- An insurance agreement covering HIPAA violation fines
Correct answer: A written contract requiring business associates to appropriately safeguard PHI they access on behalf of a covered entity
A BAA is a written contract between a covered entity and a business associate that requires the business associate to protect PHI and comply with applicable HIPAA requirements.
RHIA Compliance, Privacy, and Security 1
Under HIPAA, which rule specifically governs the security of electronic protected health information (ePHI)?