HCCA - CHPC LATEST UPDATE 2024 -2025 STUDY
GUIDE QUESTIONS WITH CORRECT DETAILED
ANSWERS/ GRADED A+
Which of the following is not considered a HIPAA Entity Designation:
1. Affiliated covered entity
2. Entity that performs healthcare and non-healthcare component activities including
both covered and non-covered functions
3. A group health plan
4. Contract arrangement with FEDEX carrier - Correct Answer - 4. Contract
arrangement with FEDEX carrier
What is Gramm-Leach-Bliley Act (GLBA)? - Correct Answer - Gramm-Leach-Bliley Act
(GLBA), also known as the Financial Services Modernization Act of 1999, includes The
Financial Privacy Rule and The Safeguards Rule requires all financial institutions to
protect customer's personal financial information.
What is an OHCA? - Correct Answer - OHCA (Organized Health Care Arrangement) it's
a clinically integrated care setting where individuals receive health care from more than
one provider.
These are joint arrangements/activities and have an Integrated Delivery System for
easy exchange of PHI data. See 45 CFR 160.103. OHCAs can also utilize a joint NPP.
See 45 CFR § 164.520(d).
ACE (Affiliated Covered Entity) do not have an Integrated Delivery System because
these are legally separate covered entities that are associated in business, or affiliated
as a result of some common control or ownership.
Both the OHCA and the ACE would allow sharing of PHI across participating entity lines
for treatment, payment, operations purposes (TPO).
pg. 1
,What's an ACE? - Correct Answer - ACE (Affiliated Covered Entity)
Legally separate covered entities that share common control/ownership and designate
themselves as a single CE for the purpose of complying with the HIPAA Privacy
standards.
ACEs do not have an Integrated Delivery System, while OHCA do, and can share a
single NPP. See 45 CFR § 164.520(d)
ACE example: a health system composed on several affiliated hospitals.
Both the OHCA and the ACE would allow sharing of PHI across participating entity lines
for treatment, payment, operations purposes (TPO).
What's a Hybrid Entity? - Correct Answer - Entity that conducts both covered functions
(or healthcare-functions) and non-covered functions (other biz/non-healthcare functions)
to elect to be a "hybrid entity."
True or False:
If disclosing PHI to legal authorities/government/public official, CE must verify identity,
for instance asking for a gov badge/ID, credential, or some proof of gov status, such gov
written letterhead, warrant, memorandum, etc. - Correct Answer - TRUE
Computerized data medical records are destroyed by - Correct Answer - Magnetic
degaussing
Covered entities participating in an Organized Health Care Arrangement are permitted
to
A. act as a single covered entity
B. utilize a single notice of privacy practices
C. share psychotherapy notes
D. operate as a hybrid entity - Correct Answer - B. utilize a single notice of privacy
practices
pg. 2
,True or False:
In cases where CE is making Fundraising communications to individuals, the individual
must be provided with an Opportunity to Object/Elect to receive such communications
(and to opt back if individual changes her/his opinion) - Correct Answer - TRUE
Covered Entity can use or disclose PHI by these 4 areas: - Correct Answer - 1. for
treatment, payment, healthcare operations (TPO)
2. for public interest in disaster relief or public emergency
3. with an opportunity to object (i.e. spouse picking up Rx)
4. with authorization granted
Covered entity includes: - Correct Answer - • Health plan (payers)
• Health care clearinghouse (process health information into standard data elements on
behalf of the CE)
• Health care provider who transmits any health info in electronic form
AND
• CE's business associate (when applicable)
What is a Controlling Health Plan (CHP)? - Correct Answer - Health plan that controls its
own business, actions, activities, and policies;
Controls the subhealth plan (SHP).
This applies to state Medicaid plans. For instance, the CHC is the state Medicaid, and
the SHP would be the local administrator.
Re: HCCA Privacy Compliance Handbook
Describe what to do with a "required" implementation specification - Correct Answer -
Implement the specification as presented
Describe what to do with an "addressable" implementation specification - Correct
Answer - Implement as presented, or if not reasonable and appropriate implement an
equivalent alternative measure.
pg. 3
, Designated Record Set (DRS) - includes: - Correct Answer - Group of records
maintained by or for a Covered Entity that comprises the following:
1. medical/billings records
2. enrollment/payment/claims adjudication/case management by health plan
3. other records used by or for covered entity to make decisions about individuals
Designated Record Set (DRS) - records excluded from DRS: - Correct Answer -
Administrative data (audit trails, appointment schedules, that don't imbed PHI).
Incident reports.
Quality Assurance Data.
Statistical reports.
DVD medical records are destroyed by - Correct Answer - Shredding and cutting
Few other examples for use or disclosure of PHI other that TPO: - Correct Answer -
Public health interest, research, serious threat, organ/tissue donation decedent
information, worker's compensation insurers.
Give examples of administrative safeguards - Correct Answer - • Policies and
procedures
• Training and education
• Designation of individuals (Ex. Security Officer)
• Contingency Planning
Give examples of physical safeguards - Correct Answer - • Facility security or access
plan
• Disposal processes and media reuse
• Data backup and storage
pg. 4
GUIDE QUESTIONS WITH CORRECT DETAILED
ANSWERS/ GRADED A+
Which of the following is not considered a HIPAA Entity Designation:
1. Affiliated covered entity
2. Entity that performs healthcare and non-healthcare component activities including
both covered and non-covered functions
3. A group health plan
4. Contract arrangement with FEDEX carrier - Correct Answer - 4. Contract
arrangement with FEDEX carrier
What is Gramm-Leach-Bliley Act (GLBA)? - Correct Answer - Gramm-Leach-Bliley Act
(GLBA), also known as the Financial Services Modernization Act of 1999, includes The
Financial Privacy Rule and The Safeguards Rule requires all financial institutions to
protect customer's personal financial information.
What is an OHCA? - Correct Answer - OHCA (Organized Health Care Arrangement) it's
a clinically integrated care setting where individuals receive health care from more than
one provider.
These are joint arrangements/activities and have an Integrated Delivery System for
easy exchange of PHI data. See 45 CFR 160.103. OHCAs can also utilize a joint NPP.
See 45 CFR § 164.520(d).
ACE (Affiliated Covered Entity) do not have an Integrated Delivery System because
these are legally separate covered entities that are associated in business, or affiliated
as a result of some common control or ownership.
Both the OHCA and the ACE would allow sharing of PHI across participating entity lines
for treatment, payment, operations purposes (TPO).
pg. 1
,What's an ACE? - Correct Answer - ACE (Affiliated Covered Entity)
Legally separate covered entities that share common control/ownership and designate
themselves as a single CE for the purpose of complying with the HIPAA Privacy
standards.
ACEs do not have an Integrated Delivery System, while OHCA do, and can share a
single NPP. See 45 CFR § 164.520(d)
ACE example: a health system composed on several affiliated hospitals.
Both the OHCA and the ACE would allow sharing of PHI across participating entity lines
for treatment, payment, operations purposes (TPO).
What's a Hybrid Entity? - Correct Answer - Entity that conducts both covered functions
(or healthcare-functions) and non-covered functions (other biz/non-healthcare functions)
to elect to be a "hybrid entity."
True or False:
If disclosing PHI to legal authorities/government/public official, CE must verify identity,
for instance asking for a gov badge/ID, credential, or some proof of gov status, such gov
written letterhead, warrant, memorandum, etc. - Correct Answer - TRUE
Computerized data medical records are destroyed by - Correct Answer - Magnetic
degaussing
Covered entities participating in an Organized Health Care Arrangement are permitted
to
A. act as a single covered entity
B. utilize a single notice of privacy practices
C. share psychotherapy notes
D. operate as a hybrid entity - Correct Answer - B. utilize a single notice of privacy
practices
pg. 2
,True or False:
In cases where CE is making Fundraising communications to individuals, the individual
must be provided with an Opportunity to Object/Elect to receive such communications
(and to opt back if individual changes her/his opinion) - Correct Answer - TRUE
Covered Entity can use or disclose PHI by these 4 areas: - Correct Answer - 1. for
treatment, payment, healthcare operations (TPO)
2. for public interest in disaster relief or public emergency
3. with an opportunity to object (i.e. spouse picking up Rx)
4. with authorization granted
Covered entity includes: - Correct Answer - • Health plan (payers)
• Health care clearinghouse (process health information into standard data elements on
behalf of the CE)
• Health care provider who transmits any health info in electronic form
AND
• CE's business associate (when applicable)
What is a Controlling Health Plan (CHP)? - Correct Answer - Health plan that controls its
own business, actions, activities, and policies;
Controls the subhealth plan (SHP).
This applies to state Medicaid plans. For instance, the CHC is the state Medicaid, and
the SHP would be the local administrator.
Re: HCCA Privacy Compliance Handbook
Describe what to do with a "required" implementation specification - Correct Answer -
Implement the specification as presented
Describe what to do with an "addressable" implementation specification - Correct
Answer - Implement as presented, or if not reasonable and appropriate implement an
equivalent alternative measure.
pg. 3
, Designated Record Set (DRS) - includes: - Correct Answer - Group of records
maintained by or for a Covered Entity that comprises the following:
1. medical/billings records
2. enrollment/payment/claims adjudication/case management by health plan
3. other records used by or for covered entity to make decisions about individuals
Designated Record Set (DRS) - records excluded from DRS: - Correct Answer -
Administrative data (audit trails, appointment schedules, that don't imbed PHI).
Incident reports.
Quality Assurance Data.
Statistical reports.
DVD medical records are destroyed by - Correct Answer - Shredding and cutting
Few other examples for use or disclosure of PHI other that TPO: - Correct Answer -
Public health interest, research, serious threat, organ/tissue donation decedent
information, worker's compensation insurers.
Give examples of administrative safeguards - Correct Answer - • Policies and
procedures
• Training and education
• Designation of individuals (Ex. Security Officer)
• Contingency Planning
Give examples of physical safeguards - Correct Answer - • Facility security or access
plan
• Disposal processes and media reuse
• Data backup and storage
pg. 4
