HIPAA Compliance and Privacy Quiz

HIPAA stands for Health Insurance Portability and Accountability Act.

Under HIPAA, covered entities must retain records of privacy policies and procedures for 10 years.

A Notice of Privacy Practices typically includes details about how the entity may use and disclose protected health information (PHI).

Medical History is considered protected health information under HIPAA.

The primary goal of the HIPAA Security Rule is to protect the confidentiality, integrity, and availability of electronic protected health information (ePHI).

Encryption of all healthcare data is NOT a requirement of the HIPAA Privacy Rule.

The 'minimum necessary' standard in HIPAA restricts access to PHI to the minimum necessary for the intended purpose.

Sending protected health information (PHI) via unencrypted email with patient consent is an example of a HIPAA-compliant disclosure.

The Office for Civil Rights (OCR) is responsible for enforcing the HIPAA Privacy Rule.

The maximum penalty for a HIPAA violation by an individual or organization is $1.5 million annually.

Pharmaceutical companies are NOT typically considered covered entities under HIPAA.

The purpose of the HIPAA Breach Notification Rule is to notify affected individuals and the Department of Health and Human Services (HHS) of breaches of unsecured protected health information (PHI).

The role of a HIPAA Privacy Officer within a covered entity is to handle data breaches and breach notifications.