HIPAA - Health Insurance Portability and Accountability Act Protected Health Information (PHI) Questions and Answers

Question 1

Which of the following data elements, when combined with a patient's medical condition, would NOT be considered Protected Health Information (PHI) under HIPAA?

Accepted Answer

The initial three digits of a zip code for a geographic area containing 25,000 people

Answer

A patient's full face photograph

Answer

The year of a patient's birth

Answer

A medical record number

Question 2

A hospital billing department outsources its coding to a third-party company. The coding company requires access to patient charts to perform its function. Under HIPAA, what is the most critical step the hospital must take before granting this access?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the coding company.

Answer

Obtain individual patient authorization for each record shared.

Answer

De-identify all patient data before sending it to the coding company.

Answer

Ensure the coding company has general liability insurance.

Question 3

A nurse is discussing a patient's care with a doctor in a semi-private room. A patient in the next bed, separated by a curtain, overhears the doctor mention the first patient's name and diagnosis. Assuming the conversation was conducted in a low voice and was necessary for treatment, how would this situation be classified under HIPAA?

Accepted Answer

An incidental disclosure.

Answer

A reportable breach of unsecured PHI.

Answer

A violation of the Minimum Necessary Rule.

Answer

A permitted disclosure for treatment purposes.

Question 4

According to the HIPAA Privacy Rule's 'Minimum Necessary' standard, a covered entity must make reasonable efforts to limit the use and disclosure of PHI. In which of the following scenarios does the Minimum Necessary standard NOT apply?

Accepted Answer

A disclosure from one healthcare provider to another for treatment purposes.

Answer

A disclosure to a business associate for billing operations.

Answer

A use of PHI for internal quality assessment activities.

Answer

A request for PHI from another covered entity for payment purposes.

Question 5

A patient discovers an error in their medical record and submits a formal written request to their provider to have it corrected. Under the HIPAA Privacy Rule, what right is the patient exercising?

Accepted Answer

The Right to Amend PHI

Answer

The Right to an Accounting of Disclosures

Answer

The Right to Restrict Disclosures

Answer

The Right of Access

Question 6

A research institution wants to use a large dataset of patient information for a study. To avoid HIPAA constraints, they decide to de-identify the data using the Safe Harbor method. Which of the following must be removed from the dataset?

Accepted Answer

The first three digits of a zip code if the area has fewer than 20,000 people.

Answer

The state of residence for all patients.

Answer

The patient's year of birth.

Answer

All patient ages over 89, aggregated into a single category of '90 or older'.