CITI - HIPAA Training Exam with
Accurate Solutions
In the US, privacy protections for health information come from: - ANSWER-Privacy
protections come from all of these sources - both federal and state law, as well as the
requirements of private certification organizations.
Privacy, in the health information context discussed here, refers to: - ANSWER-The
rules about who can access health information, and under what circumstances.
Patients must be provided with federally-mandated Privacy Notices when they first
encounter direct treatment providers. Which of the following is an implication of that for
clinicians? - ANSWER-The provision of the notice just before receiving treatment means
clinicians will receive some questions about privacy issues. There is an obligation to
know the answers, or to be able to direct the patient to someone who does.
Which of the following is true? - ANSWER-The "minimum necessary" standard applies
to treatment-related uses, but not treatment-related disclosures, so as to avoid any
interference with information exchanges among practitioners.
Which category of health information does HIPAA extend "extra" protections, with a
requirement for separate authorization? - ANSWER-Psychotherapy notes
Which best describes the role of the clinician in managing privacy matters? - ANSWER-
How clinicians handle information inevitably sets the tone for everyone else, so the
example they set is critical.
When required, the information provided to the data subject in a HIPAA disclosure
accounting ... - ANSWER-must be more detailed for disclosures that involve fewer than
50 subject records.
The HIPAA "minimum necessary" standard applies... - ANSWER-To all human subjects
research that uses PHI without an authorization from the data subject.
HIPAA protects a category of information known as protected health information (PHI).
PHI covered under HIPAA includes: - ANSWER-Identifiable health information that is
created or held by covered entities and their business associates.
A covered entity may use or disclose PHI without an authorization, or documentation of
a waiver or an alteration of authorization, for all of the following EXCEPT: - ANSWER-
Data that does not cross state lines when disclosed by the covered entity.
, If you're unsure about the particulars of HIPAA research requirements at your
organization or have questions, you can usually consult with: - ANSWER-An
organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security
official ("Security Officer"), depending on the issue.
HIPAA includes in its definition of "research," activities related to: - ANSWER-
Development of generalizable knowledge.
A HIPAA authorization has which of the following characteristics: - ANSWER-Uses
"plain language" that the data subject can understand, similar to the requirement for an
informed consent document.
HIPAA's protections for health information used for research purposes... - ANSWER-
Supplement those of the Common Rule and FDA.
How are the ethical standards for student uses and disclosures of patients' health
information different from those for regular members of the healthcare workforce? -
ANSWER-Some would say it is higher, because patients do not always benefit from
students' access to their data.
For health information privacy and security, are the legal and regulatory requirements
for students different from those for regular members of the healthcare workforce? -
ANSWER-No, students must meet the same standards as a regular member of the
workforce performing the same tasks.
Use of social media tools and other new technologies to facilitate training-related
communications is: - ANSWER-Depends on the organization's policies, so you should
check with your organization's officials about what is allowed or prohibited.
In regard to reporting privacy or security problems, are the requirements for students
the same as for regular workers? - ANSWER-Yes. Like any other member of the
workforce, students are obligated to report problems they are not in a position to
correct.
Patients have to provide an additional, specific authorization for training uses and
disclosures of their information. - ANSWER-False
Which of the following is a good practice if one wishes to avoid "social engineering"
attacks? - ANSWER-All of the above
Which of these is not a good practice for controlling computer access? - ANSWER-
Logging into systems with a shared user-ID or password
Which of these is not a good practice for protecting computing devices? - ANSWER-
Login and screen-saver passwords, or token or biometric mechanisms, are disabled to
make it easier to use the device quickly.
Accurate Solutions
In the US, privacy protections for health information come from: - ANSWER-Privacy
protections come from all of these sources - both federal and state law, as well as the
requirements of private certification organizations.
Privacy, in the health information context discussed here, refers to: - ANSWER-The
rules about who can access health information, and under what circumstances.
Patients must be provided with federally-mandated Privacy Notices when they first
encounter direct treatment providers. Which of the following is an implication of that for
clinicians? - ANSWER-The provision of the notice just before receiving treatment means
clinicians will receive some questions about privacy issues. There is an obligation to
know the answers, or to be able to direct the patient to someone who does.
Which of the following is true? - ANSWER-The "minimum necessary" standard applies
to treatment-related uses, but not treatment-related disclosures, so as to avoid any
interference with information exchanges among practitioners.
Which category of health information does HIPAA extend "extra" protections, with a
requirement for separate authorization? - ANSWER-Psychotherapy notes
Which best describes the role of the clinician in managing privacy matters? - ANSWER-
How clinicians handle information inevitably sets the tone for everyone else, so the
example they set is critical.
When required, the information provided to the data subject in a HIPAA disclosure
accounting ... - ANSWER-must be more detailed for disclosures that involve fewer than
50 subject records.
The HIPAA "minimum necessary" standard applies... - ANSWER-To all human subjects
research that uses PHI without an authorization from the data subject.
HIPAA protects a category of information known as protected health information (PHI).
PHI covered under HIPAA includes: - ANSWER-Identifiable health information that is
created or held by covered entities and their business associates.
A covered entity may use or disclose PHI without an authorization, or documentation of
a waiver or an alteration of authorization, for all of the following EXCEPT: - ANSWER-
Data that does not cross state lines when disclosed by the covered entity.
, If you're unsure about the particulars of HIPAA research requirements at your
organization or have questions, you can usually consult with: - ANSWER-An
organizational IRB or Privacy Board, privacy official ("Privacy Officer"), or security
official ("Security Officer"), depending on the issue.
HIPAA includes in its definition of "research," activities related to: - ANSWER-
Development of generalizable knowledge.
A HIPAA authorization has which of the following characteristics: - ANSWER-Uses
"plain language" that the data subject can understand, similar to the requirement for an
informed consent document.
HIPAA's protections for health information used for research purposes... - ANSWER-
Supplement those of the Common Rule and FDA.
How are the ethical standards for student uses and disclosures of patients' health
information different from those for regular members of the healthcare workforce? -
ANSWER-Some would say it is higher, because patients do not always benefit from
students' access to their data.
For health information privacy and security, are the legal and regulatory requirements
for students different from those for regular members of the healthcare workforce? -
ANSWER-No, students must meet the same standards as a regular member of the
workforce performing the same tasks.
Use of social media tools and other new technologies to facilitate training-related
communications is: - ANSWER-Depends on the organization's policies, so you should
check with your organization's officials about what is allowed or prohibited.
In regard to reporting privacy or security problems, are the requirements for students
the same as for regular workers? - ANSWER-Yes. Like any other member of the
workforce, students are obligated to report problems they are not in a position to
correct.
Patients have to provide an additional, specific authorization for training uses and
disclosures of their information. - ANSWER-False
Which of the following is a good practice if one wishes to avoid "social engineering"
attacks? - ANSWER-All of the above
Which of these is not a good practice for controlling computer access? - ANSWER-
Logging into systems with a shared user-ID or password
Which of these is not a good practice for protecting computing devices? - ANSWER-
Login and screen-saver passwords, or token or biometric mechanisms, are disabled to
make it easier to use the device quickly.
