1. What is the primary purpose of HIPAA?
A. Provide free healthcare to all citizens
B. Standardize international medical coding
C. Protect PHI from unauthorized disclosure, prevent fraud, make insurance portable, and
standardize electronic billing
D. Replace all state privacy laws
Rationale: HIPAA's four main goals are protecting PHI, preventing fraud/waste/abuse via
Administrative Simplification, ensuring portability under ERISA, and moving to national
electronic billing standards.
2. HIPAA resides in which CFR section?
A. 42 CFR Part 2
B. 45 CFR sections 164.102 through 164.534
C. 21 CFR Part 11
D. 38 USC 7332
Rationale: The HIPAA Privacy, Security, Breach, and General rules are codified at 45 CFR Part
164, Subparts A through E.
3. Which subparts of HIPAA Part 164 address Security and Privacy?
A. Subpart A and Subpart B
B. Subpart B and Subpart D
C. Subpart C (Security) and Subpart E (Privacy)
D. Subpart D and Subpart E
Rationale: Subpart C covers Security Rule standards for ePHI; Subpart E covers Privacy Rule
standards for all forms of PHI.
,4. A small dental practice submits electronic claims to Medicare. How do you determine if it is a
Covered Entity?
A. It has more than 10 employees
B. It accepts credit card payments
C. It is a healthcare provider that electronically transmits one of the nine standard HIPAA
transactions
D. It has a website
Rationale: A healthcare provider becomes a covered entity only if it electronically transmits any
of the nine defined transactions (e.g., claims, eligibility, referrals).
5. Which Act, established in 1974, restricts how federal government agencies share information
maintained in systems of records?
A. The Privacy Act of 1974
B. Gramm-Leach-Bliley Act
C. FERPA
D. Sarbanes-Oxley Act
Rationale: The Privacy Act of 1974 governs federal agencies' collection, use, and sharing of
personally identifiable information in systems of records.
6. Which is NOT considered a HIPAA Entity Designation?
A. Affiliated covered entity
B. Hybrid entity
C. Group health plan
D. Contract arrangement with FEDEX carrier
Rationale: A contract with a shipping carrier is a vendor relationship, not a HIPAA entity
designation; ACE, hybrid entity, and group health plan are recognized designations.
7. What does the Gramm-Leach-Bliley Act (GLBA) require?
A. Protection of student education records
B. Financial institutions to protect customers' personal financial information
C. Protection of genetic information
,D. Breach notification for healthcare entities
Rationale: GLBA, also known as the Financial Services Modernization Act, includes the Financial
Privacy Rule and Safeguards Rule for financial institutions.
8. What is an Organized Health Care Arrangement (OHCA)?
A. A single hospital with one medical staff
B. A clinically integrated care setting where individuals receive care from multiple providers and
share PHI for TPO
C. A legal entity that does not share PHI
D. A government-run health plan
Rationale: An OHCA is a clinically integrated setting (e.g., integrated delivery system) that allows
joint PHI sharing for TPO and can use a joint NPP.
9. What is an Affiliated Covered Entity (ACE)?
A. A single covered entity with multiple departments
B. Legally separate covered entities with common ownership that designate themselves as a
single CE for HIPAA compliance
C. Any business associate of a hospital
D. A health plan that outsources claims processing
Rationale: ACEs are separate legal entities under common control that elect to act as a single
CE; they do not have an integrated delivery system like an OHCA.
10. A university has a medical center and a separate undergraduate college. The medical center
must comply with HIPAA, but the undergraduate records do not. This describes what entity
type?
A. Affiliated covered entity
B. Organized health care arrangement
C. Hybrid entity
D. Business associate
Rationale: A hybrid entity conducts both covered healthcare functions and non-covered
functions, electing to apply HIPAA only to its healthcare component.
, 11. The transmission of information between two parties to carry out financial or administrative
activities related to health care is called a?
A. Prior authorization
B. Healthcare transaction
C. Remittance advice
D. Claims attachment
Rationale: A healthcare transaction is the electronic exchange of information for financial or
administrative activities, such as claims or eligibility inquiries.
12. Which of the following is an example of a Business Associate?
A. A hospital's staff physician
B. A patient's family member
C. An independent medical transcriptionist who receives PHI to create reports
D. A janitorial service that does not access PHI
Rationale: A business associate performs functions involving PHI on behalf of a CE, such as
transcription, claims processing, or legal services.
13. True or False: A hospital is not required to have a business associate contract with a
specialist to whom it refers a patient and transmits the medical chart for treatment.
A. True
B. False
Rationale: Use and disclosure of PHI for treatment purposes (TPO) does not require a BAA;
treatment is an exception to the business associate contract requirement.
14. Under HITECH, business associates are:
A. Exempt from HIPAA penalties
B. Only liable if they have a written contract
C. Directly responsible for HIPAA compliance and subject to penalties
D. Not required to report breaches
Rationale: HITECH made business associates directly liable for HIPAA Privacy and Security Rule
violations, including penalties for noncompliance.
A. Provide free healthcare to all citizens
B. Standardize international medical coding
C. Protect PHI from unauthorized disclosure, prevent fraud, make insurance portable, and
standardize electronic billing
D. Replace all state privacy laws
Rationale: HIPAA's four main goals are protecting PHI, preventing fraud/waste/abuse via
Administrative Simplification, ensuring portability under ERISA, and moving to national
electronic billing standards.
2. HIPAA resides in which CFR section?
A. 42 CFR Part 2
B. 45 CFR sections 164.102 through 164.534
C. 21 CFR Part 11
D. 38 USC 7332
Rationale: The HIPAA Privacy, Security, Breach, and General rules are codified at 45 CFR Part
164, Subparts A through E.
3. Which subparts of HIPAA Part 164 address Security and Privacy?
A. Subpart A and Subpart B
B. Subpart B and Subpart D
C. Subpart C (Security) and Subpart E (Privacy)
D. Subpart D and Subpart E
Rationale: Subpart C covers Security Rule standards for ePHI; Subpart E covers Privacy Rule
standards for all forms of PHI.
,4. A small dental practice submits electronic claims to Medicare. How do you determine if it is a
Covered Entity?
A. It has more than 10 employees
B. It accepts credit card payments
C. It is a healthcare provider that electronically transmits one of the nine standard HIPAA
transactions
D. It has a website
Rationale: A healthcare provider becomes a covered entity only if it electronically transmits any
of the nine defined transactions (e.g., claims, eligibility, referrals).
5. Which Act, established in 1974, restricts how federal government agencies share information
maintained in systems of records?
A. The Privacy Act of 1974
B. Gramm-Leach-Bliley Act
C. FERPA
D. Sarbanes-Oxley Act
Rationale: The Privacy Act of 1974 governs federal agencies' collection, use, and sharing of
personally identifiable information in systems of records.
6. Which is NOT considered a HIPAA Entity Designation?
A. Affiliated covered entity
B. Hybrid entity
C. Group health plan
D. Contract arrangement with FEDEX carrier
Rationale: A contract with a shipping carrier is a vendor relationship, not a HIPAA entity
designation; ACE, hybrid entity, and group health plan are recognized designations.
7. What does the Gramm-Leach-Bliley Act (GLBA) require?
A. Protection of student education records
B. Financial institutions to protect customers' personal financial information
C. Protection of genetic information
,D. Breach notification for healthcare entities
Rationale: GLBA, also known as the Financial Services Modernization Act, includes the Financial
Privacy Rule and Safeguards Rule for financial institutions.
8. What is an Organized Health Care Arrangement (OHCA)?
A. A single hospital with one medical staff
B. A clinically integrated care setting where individuals receive care from multiple providers and
share PHI for TPO
C. A legal entity that does not share PHI
D. A government-run health plan
Rationale: An OHCA is a clinically integrated setting (e.g., integrated delivery system) that allows
joint PHI sharing for TPO and can use a joint NPP.
9. What is an Affiliated Covered Entity (ACE)?
A. A single covered entity with multiple departments
B. Legally separate covered entities with common ownership that designate themselves as a
single CE for HIPAA compliance
C. Any business associate of a hospital
D. A health plan that outsources claims processing
Rationale: ACEs are separate legal entities under common control that elect to act as a single
CE; they do not have an integrated delivery system like an OHCA.
10. A university has a medical center and a separate undergraduate college. The medical center
must comply with HIPAA, but the undergraduate records do not. This describes what entity
type?
A. Affiliated covered entity
B. Organized health care arrangement
C. Hybrid entity
D. Business associate
Rationale: A hybrid entity conducts both covered healthcare functions and non-covered
functions, electing to apply HIPAA only to its healthcare component.
, 11. The transmission of information between two parties to carry out financial or administrative
activities related to health care is called a?
A. Prior authorization
B. Healthcare transaction
C. Remittance advice
D. Claims attachment
Rationale: A healthcare transaction is the electronic exchange of information for financial or
administrative activities, such as claims or eligibility inquiries.
12. Which of the following is an example of a Business Associate?
A. A hospital's staff physician
B. A patient's family member
C. An independent medical transcriptionist who receives PHI to create reports
D. A janitorial service that does not access PHI
Rationale: A business associate performs functions involving PHI on behalf of a CE, such as
transcription, claims processing, or legal services.
13. True or False: A hospital is not required to have a business associate contract with a
specialist to whom it refers a patient and transmits the medical chart for treatment.
A. True
B. False
Rationale: Use and disclosure of PHI for treatment purposes (TPO) does not require a BAA;
treatment is an exception to the business associate contract requirement.
14. Under HITECH, business associates are:
A. Exempt from HIPAA penalties
B. Only liable if they have a written contract
C. Directly responsible for HIPAA compliance and subject to penalties
D. Not required to report breaches
Rationale: HITECH made business associates directly liable for HIPAA Privacy and Security Rule
violations, including penalties for noncompliance.
