CCS Security Principles and Practices 2

Question 1

Under HIPAA, which of the following is NOT considered protected health information (PHI)?

Accepted Answer

De-identified patient data with all 18 identifiers removed

Answer

Patient diagnosis stored in an EHR

Answer

Patient name linked to a prescription

Answer

Patient address included in a lab report

Question 2

A coding specialist receives a request for medical records from a patient's employer. Under HIPAA, the coder should:

Accepted Answer

Require a valid patient authorization before releasing any records

Answer

Release the records because employers pay for insurance

Answer

Release only employment-related records

Answer

Deny the request and notify law enforcement

Question 3

Which security measure ensures that electronic PHI has not been altered or destroyed in an unauthorized manner?

Accepted Answer

Integrity control

Answer

Confidentiality control

Answer

Availability control

Answer

Authentication control

Question 4

A hospital's coding department stores patient files on shared drives. Which access control approach best aligns with the minimum necessary standard?

Accepted Answer

Access is limited to only the data needed to perform each job function

Answer

All staff have full read/write access to all patient files

Answer

Administrative staff control all access permissions personally

Answer

Physicians have unrestricted access, coders have none

Question 5

What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

Accepted Answer

To ensure vendors who handle PHI comply with HIPAA privacy and security rules

Answer

To authorize billing for covered services

Answer

To establish payment terms between providers and insurers

Answer

To document employee training completion

Question 6

An audit log in a health information system primarily serves which security purpose?

Accepted Answer

Tracking and reviewing who accessed or modified patient records

Answer

Encrypting data during transmission

Answer

Blocking unauthorized users from logging in

Answer

Automatically backing up patient data

Question 7

When a covered entity discovers a breach of unsecured PHI affecting 600 patients, HIPAA requires notification to:

Accepted Answer

Affected individuals, HHS, and prominent local media outlets

Answer

The FBI and local police only

Answer

Only the patients affected, within 30 days

Answer

Only HHS, within 60 days