Regulatory Compliance & Standards Flashcards
7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance & Standards flashcards as text
A hospital shares PHI with a medical transcription company. Under HIPAA, what document must be in place before sharing?
Answer: Business Associate Agreement (BAA)
A Business Associate Agreement (BAA) is required before a covered entity shares PHI with a business associate performing services on its behalf.
Which of the following constitutes a 'limited data set' under HIPAA?
Answer: PHI with direct identifiers removed but dates and geographic data retained
A limited data set removes direct identifiers (like names and SSNs) but may retain dates, ages, and geographic subdivisions larger than a street address.
Under the HIPAA Privacy Rule, which of the following is a permitted disclosure without patient authorization?
Answer: Disclosing PHI for treatment, payment, or healthcare operations (TPO)
HIPAA explicitly permits PHI disclosure for treatment, payment, and healthcare operations (TPO) without requiring patient authorization.
A patient requests an amendment to their medical record, which the provider denies. What must the provider include with the denial?
Answer: A written denial with the basis for denial and information on how the individual may submit a statement of disagreement
When denying an amendment request, the covered entity must provide a written denial explaining the basis and inform the patient of their right to submit a statement of disagreement.
The Omnibus Rule of 2013 modified HIPAA by changing which aspect of breach notification?
Answer: It eliminated the harm threshold, making any unauthorized PHI access presumed a breach
The Omnibus Rule replaced the 'harm threshold' with a presumption that any impermissible PHI use or disclosure is a breach unless the entity can demonstrate low probability of compromise.
Which HIPAA provision grants individuals the right to request restrictions on disclosures of their PHI to health plans for services they paid for out-of-pocket in full?
Answer: Right to Restrict Disclosure
Under the Omnibus Rule, covered entities must honor a patient's request to restrict disclosure to a health plan for items or services paid entirely out-of-pocket.
For workforce HIPAA training, what does the Security Rule require regarding documentation?
Answer: Policies and procedures must be retained for a minimum of 6 years
The HIPAA Security Rule requires covered entities to retain security policies, procedures, and training records for at least 6 years from creation or last effective date.