RHIT HIPAA Privacy and Security 2 — Questions and Answers
Question 1: Under HIPAA, which of the following is considered a 'covered entity'?
- A medical software vendor
- A health plan that pays for medical care (Correct answer)
- A janitorial company servicing a hospital
- An IT consultant hired by a clinic
Correct answer: A health plan that pays for medical care
Health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically are the three categories of covered entities under HIPAA.
Question 2: A patient requests access to their medical records. Under HIPAA, the covered entity must provide access within how many days?
- 15 days
- 30 days (Correct answer)
- 60 days
- 90 days
Correct answer: 30 days
HIPAA requires covered entities to provide access to requested records within 30 days, with one 30-day extension allowed if the entity notifies the patient.
Question 3: Which HIPAA rule establishes national standards for protecting electronic PHI?
- Privacy Rule
- Security Rule (Correct answer)
- Breach Notification Rule
- Enforcement Rule
Correct answer: Security Rule
The HIPAA Security Rule specifically addresses the protection of electronic protected health information (ePHI) through administrative, physical, and technical safeguards.
Question 4: A business associate agreement (BAA) is required when a vendor performs which type of function?
- Delivers office supplies to a clinic
- Maintains the parking lot of a hospital
- Processes PHI on behalf of a covered entity (Correct answer)
- Provides legal services unrelated to PHI
Correct answer: Processes PHI on behalf of a covered entity
A BAA is required when a vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity.
Question 5: Which of the following is an example of a physical safeguard under the HIPAA Security Rule?
- Encrypting data in transit
- Implementing audit controls
- Using facility access controls to limit entry to data centers (Correct answer)
- Assigning unique user IDs
Correct answer: Using facility access controls to limit entry to data centers
Physical safeguards include facility access controls, workstation use policies, and device and media controls to protect physical access to ePHI.
Question 6: Under HIPAA's minimum necessary standard, how much PHI should be disclosed?
- All information in the medical record
- Only the information reasonably necessary to accomplish the purpose (Correct answer)
- Whatever the patient authorizes
- Any information requested by another provider
Correct answer: Only the information reasonably necessary to accomplish the purpose
The minimum necessary standard requires covered entities to disclose only the amount of PHI needed to fulfill the specific purpose of the request.
Question 7: Which of the following is NOT included in HIPAA's definition of protected health information (PHI)?
- Patient's name linked to a diagnosis
- De-identified health information (Correct answer)
- Patient's address combined with treatment dates
- Social Security number tied to a health condition
Correct answer: De-identified health information
De-identified information has had all 18 HIPAA identifiers removed and is no longer considered PHI, making it not subject to HIPAA protections.
RHIT HIPAA Privacy and Security 2
Under HIPAA, which of the following is considered a 'covered entity'?