Practice Test Geeks(CHP) Certified HIPAA Professional Practice Test
← All CHP Flashcard Decks

Documentation & Record Keeping Flashcards

7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Documentation & Record Keeping flashcards as text

  1. Under the HIPAA Privacy Rule, covered entities must retain documentation of their privacy policies and procedures for how long?

    Answer: 6 years from creation or last effective date

    The HIPAA Privacy Rule requires covered entities to retain documentation of policies, procedures, and related records for 6 years from the date of creation or the date it was last in effect, whichever is later.

  2. A Notice of Privacy Practices (NPP) acknowledgment form cannot be obtained from a patient. What must the covered entity do?

    Answer: Document the good-faith effort to obtain acknowledgment and the reason it was not obtained

    When a covered entity cannot obtain a patient's written acknowledgment of the NPP, it must document its good-faith attempt and the reason acknowledgment was not obtained.

  3. Which document must a covered entity make available to individuals upon request under the HIPAA Privacy Rule?

    Answer: The Notice of Privacy Practices

    The Notice of Privacy Practices must be provided to individuals upon request and must also be posted at the covered entity's physical service delivery site.

  4. When a covered entity uses or discloses PHI for research with a waiver of authorization, what documentation must be retained?

    Answer: Documentation of the IRB or Privacy Board waiver approval

    Covered entities must retain documentation showing that an IRB or Privacy Board approved a waiver or alteration of authorization for research use or disclosure of PHI.

  5. What is required when a covered entity agrees to restrict the use or disclosure of an individual's PHI?

    Answer: The restriction must be documented in writing

    Under the Privacy Rule, when a covered entity agrees to a requested restriction on PHI use or disclosure, that restriction must be documented.

  6. How long must a covered entity retain records of its HIPAA training program?

    Answer: 6 years from the date of the training or last effective date

    Training documentation, like all required HIPAA policies and procedures records, must be retained for 6 years from the date created or last in effect.

  7. A covered entity sanctions an employee for a Privacy Rule violation. What documentation is required?

    Answer: Documentation of the sanction applied must be retained per HIPAA requirements

    Covered entities must apply appropriate sanctions against workforce members who violate privacy policies and must document those sanctions as part of their required records.