#1
Which law primarily governs the protection of personal health information in the United States?
The Health Insurance Portability and Accountability Act (HIPAA)
ExplanationHIPAA governs the protection of personal health information in the US.
#2
Which of the following best describes a breach of healthcare information?
A healthcare professional discussing a patient's condition with another patient
ExplanationA breach occurs when healthcare information is improperly disclosed, such as discussing a patient's condition with another patient.
#3
What does PHI stand for in the context of healthcare compliance?
Protected Health Information
ExplanationPHI stands for Protected Health Information.
#4
Under HIPAA, a 'covered entity' includes which of the following?
Health plans, healthcare clearinghouses, and healthcare providers who transmit any health information in electronic form
ExplanationCovered entities under HIPAA include health plans, healthcare clearinghouses, and healthcare providers transmitting health information electronically.
#5
What is required for a healthcare provider to share PHI with another provider for treatment purposes under HIPAA?
No specific authorization is required if the information is for treatment purposes
ExplanationSharing PHI for treatment purposes between providers doesn't require specific authorization under HIPAA.
#6
Which HIPAA title deals specifically with the privacy and security of patient health information?
Title II - Preventing Health Care Fraud and Abuse; Administrative Simplification; Medical Liability Reform
ExplanationTitle II of HIPAA addresses the privacy and security of patient health information.
#7
Which of the following is a requirement for compliance with HIPAA's Privacy Rule?
Healthcare providers must provide patients with a notice of their privacy practices.
ExplanationHIPAA's Privacy Rule requires healthcare providers to inform patients about privacy practices.
#8
What is the minimum necessary standard in healthcare?
Providing the minimum amount of patient information necessary to accomplish the intended purpose
ExplanationThe minimum necessary standard involves sharing only the necessary patient information for a particular purpose.
#9
What is considered a best practice for securing electronic PHI (ePHI)?
Encrypting ePHI stored on any portable device
ExplanationEncrypting ePHI on portable devices is a recommended security measure.
#10
Which entity enforces HIPAA compliance?
Office for Civil Rights (OCR)
ExplanationHIPAA compliance is enforced by the Office for Civil Rights (OCR).
#11
Under HIPAA, which of the following is NOT a patient right regarding their health information?
The right to obtain a copy of their health records within 15 days
ExplanationThe right to obtain health records within 15 days is not explicitly granted to patients under HIPAA.
#12
Which of the following is a key component of the Security Rule under HIPAA?
Implementation of physical, administrative, and technical safeguards
ExplanationThe Security Rule of HIPAA requires the implementation of various safeguards including physical, administrative, and technical measures.
#13
Under HIPAA, when must a covered entity notify individuals of a breach of unsecured protected health information?
Without unreasonable delay and in no case later than 60 days following the discovery of the breach
ExplanationCovered entities must notify individuals of a breach without undue delay, but no later than 60 days after discovery.
#14
In the context of HIPAA, what is required for the use or disclosure of PHI for research purposes without an individual's authorization?
A waiver of authorization approved by an Institutional Review Board (IRB) or Privacy Board
ExplanationHIPAA requires a waiver of authorization from an IRB or Privacy Board for using or disclosing PHI for research without individual consent.
#15
How often must a covered entity review and update its HIPAA security measures?
As needed, based on changes in technology or operations, but at least annually
ExplanationCovered entities must review and update HIPAA security measures as necessary, considering technological and operational changes, and at least annually.