CBCS Regulatory Compliance and HIPAA 2

Question 1

What are the four HIPAA Administrative Simplification standards?

Accepted Answer

Transactions and Code Sets, Privacy, Security, and National Identifier standards

Answer

Privacy, Security, Enforcement, and Breach Notification

Answer

Privacy, Security, Electronic Claims, and Patient Rights

Answer

Covered Entities, Business Associates, PHI Protection, and Audit Controls

Question 2

What constitutes Protected Health Information (PHI) under HIPAA?

Accepted Answer

Individually identifiable health information in any form (electronic, paper, oral) held or transmitted by a covered entity or business associate

Answer

Only information stored in electronic medical records

Answer

Only information relating to diagnoses and treatment plans

Answer

Health information that a patient has specifically requested be kept private

Question 3

What is a Business Associate Agreement (BAA) under HIPAA?

Accepted Answer

A written contract between a covered entity and a business associate that specifies permitted uses of PHI and requires the business associate to protect PHI

Answer

A contract between an insurance company and a healthcare provider specifying reimbursement rates

Answer

An agreement between two competing healthcare providers not to share patient information

Answer

A consent form signed by patients authorizing their information to be shared with third parties

Question 4

What is the HIPAA Security Rule's requirement for electronic PHI (ePHI)?

Accepted Answer

Covered entities must implement administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of ePHI

Answer

ePHI must be stored only on servers within the United States

Answer

ePHI must be encrypted using AES-256 encryption at all times

Answer

ePHI access must be limited to licensed healthcare providers only

Question 5

What are patients' rights under the HIPAA Privacy Rule?

Accepted Answer

Rights including access to their PHI, request for amendments, accounting of disclosures, right to restrict certain uses/disclosures, and right to receive confidential communications

Answer

The right to have all their medical bills forgiven if information is disclosed without permission

Answer

The exclusive right to decide who can access their complete medical record, with no exceptions

Answer

The right to have all of their PHI destroyed upon request

Question 6

What is a HIPAA breach and what are the notification requirements?

Accepted Answer

An impermissible acquisition, access, use, or disclosure of PHI that compromises its security or privacy, requiring notifications to individuals, HHS, and potentially the media

Answer

Any unauthorized viewing of PHI by a non-clinical staff member, requiring immediate patient notification

Answer

Only a cyberattack that exposes ePHI to external hackers, requiring law enforcement notification

Answer

Any accidental mailing of a bill to the wrong address, requiring no notification