#1
Which law primarily governs the protection of personal health information in the United States?
The Health and Safety Code
The Health Insurance Portability and Accountability Act (HIPAA)
The Affordable Care Act
The Personal Information Protection and Electronic Documents Act
#2
Which of the following best describes a breach of healthcare information?
A healthcare professional discussing a patient's condition with another patient
A patient refusing to provide their health history
A healthcare provider increasing the security of their IT systems
A patient posting their own health information on social media
#3
What does PHI stand for in the context of healthcare compliance?
Personal Health Information
Protected Health Information
Private Healthcare Institute
Public Health Information
#4
Under HIPAA, a 'covered entity' includes which of the following?
Healthcare clearinghouses only
Health plans, healthcare clearinghouses, and healthcare providers who transmit any health information in electronic form
Only healthcare providers who accept Medicare
Pharmaceutical companies
#5
What is required for a healthcare provider to share PHI with another provider for treatment purposes under HIPAA?
A written consent form from the patient for each instance of information sharing
Verbal agreement from the patient
No specific authorization is required if the information is for treatment purposes
A court order
#6
Which HIPAA title deals specifically with the privacy and security of patient health information?
Title I - Health Care Access, Portability, and Renewability
Title II - Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform
Title III - Tax-related health provisions
Title IV - Application and enforcement of group health plan requirements
#7
Which of the following is a requirement for compliance with HIPAA's Privacy Rule?
Healthcare providers must share patient information with any requesting family member.
Healthcare providers must obtain written consent from patients before disclosing any health information.
Healthcare providers may use patient information for marketing purposes without specific authorization.
Healthcare providers must provide patients with a notice of their privacy practices.
#8
What is the minimum necessary standard in healthcare?
Using the least amount of medication necessary to treat a condition
Providing the minimum amount of patient information necessary to accomplish the intended purpose
Charging the minimum amount possible for healthcare services
Hiring the minimum number of staff necessary to run a healthcare facility
#9
What is considered a best practice for securing electronic PHI (ePHI)?
Using the same password across multiple systems for convenience
Encrypting ePHI stored on any portable device
Sending ePHI via email without encryption for faster communication
Storing ePHI on public cloud servers without access controls
#10
Which entity enforces HIPAA compliance?
Centers for Disease Control and Prevention (CDC)
Food and Drug Administration (FDA)
Office for Civil Rights (OCR)
Department of Health and Human Services (HHS)
#11
Under HIPAA, which of the following is NOT a patient right regarding their health information?
The right to obtain a copy of their health records within 15 days
The right to request amendments to their health records
The right to receive an accounting of disclosures of their PHI
The right to request restrictions on certain uses and disclosures of their PHI
#12
Which of the following is a key component of the Security Rule under HIPAA?
Annual privacy training for all employees
Implementation of physical, administrative, and technical safeguards
Mandatory encryption of all emails containing PHI
Unlimited access to PHI for all healthcare employees
#13
Under HIPAA, when must a covered entity notify individuals of a breach of unsecured protected health information?
Within 60 days of the end of the calendar year in which the breach was discovered
Within 10 business days after the breach was discovered
Immediately upon discovery of the breach
Without unreasonable delay and in no case later than 60 days following the discovery of the breach
#14
In the context of HIPAA, what is required for the use or disclosure of PHI for research purposes without an individual's authorization?
A signed agreement from the hospital's legal department
A waiver of authorization approved by an Institutional Review Board (IRB) or Privacy Board
Verbal consent from the patient
Notification to the Department of Health and Human Services (HHS)
#15
How often must a covered entity review and update its HIPAA security measures?
At least every 10 years
Only after a breach has occurred
As needed, based on changes in technology or operations, but at least annually
Every five years, in compliance with federal audit requirements