CERTIFIED IN HEALTHCARE PRIVACY AND SECURITY
(CHPS) EXAM QUESTIONS WITH 100% CORRECT
ANSWERS.
1) Which of the following is a goal of the minimum necessary requirement under the
d. d. d. d. d. d. d. d. d. d. d. d. d.
HIPAA Privacy Rule? - Correct Answer-Ensure that all workforce members have
d. d. d. d. d. d. d. d. d. d. d.
the same access to PHI within an organization
d. d. d. d. d. d. d. d. d.
2) A patient is checking in at the registration desk and overhears a conversation
d. d. d. d. d. d. d. d. d. d. d. d.
between another patient and the billing specialist regarding a specific diagnosis
d. d. d. d. d. d. d. d. d. d. d.
that is not being covered under the patient's insurance. This is an example of
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
what type of disclosure? - Correct Answer-Incidental
d. d. d. d. d. d. d. d.
3) Which of the following is the only scenario where breach notification can be
d. d. d. d. d. d. d. d. d. d. d. d.
delayed past the 60-day notification requirement? - Correct Answer-When law
d. d. d. d. d. d. d. d. d. d.
enforcement requests a delay due to open criminal investigation.
d. d. d. d. d. d. d. d. d. d.
4) During a recent change in a computer system's access, an organization
d. d. d. d. d. d. d. d. d. d.
determined that they were going to create role-based access defined on the need
d. d. d. d. d. d. d. d. d. d. d. d. d.
for each job type within the organization. This is an example of application of
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
which of the following: - Correct Answer-Minimum necessary
d. d. d. d. d. d. d. d. d.
5) An organization just finished updating the minimum necessary policy and
d. d. d. d. d. d. d. d. d.
procedure. The new policy took effect on February 12, 2016. How long do they
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
have to maintain the previous version of the policy? - Correct Answer-February
d. d. d. d. d. d. d. d. d. d. d. d.
12, 2020
d. d. d.
6) Which of the following is considered a patient's right under the HIPAA Privacy
d. d. d. d. d. d. d. d. d. d. d. d.
Rule? - Correct Answer-Accounting of disclosure (AOD)
d. d. d. d. d. d. d. d.
7) How long does a covered entity have to respond to an accounting of disclosure
d. d. d. d. d. d. d. d. d. d. d. d. d.
request? - Correct Answer-30 days with one 30 day extension.
d. d. d. d. d. d. d. d. d. d. d.
8) A patient has requested three accounting-of-disclosures reports in the past
d. d. d. d. d. d. d. d. d.
month. Which of the following statements is true regarding the accounting of
d. d. d. d. d. d. d. d. d. d. d. d.
disclosure? - Correct Answer-The CE is allowed to charge a reasonable, cost-
d. d. d. d. d. d. d. d. d. d. d. d.
, based fee for the second and third request for accounting disclosures and must
d. d. d. d. d. d. d. d. d. d. d. d.
inform the patient prior.
d. d. d. d. d.
9) In the final HIPAA Omnibus Rule of 2013, which of the following was added to
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
the regulations regarding patient access? - Correct Answer-A patient has a right
d. d. d. d. d. d. d. d. d. d. d. d.
to receive his or her designated record set electronically, if maintained
d. d. d. d. d. d. d. d. d. d. d.
electronically.
d. d.
10) If a state requires that all medical records are disclosed within 15 days from the
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.request, and HIPAA requires for disclosures to be completed within 30 days
d. d. d. d. d. d. d. d. d. d. d.
d.from the request, which timeline should be followed? - Correct Answer-State
d. d. d. d. d. d. d. d. d. d.
d.law because it is more stringent than HIPAA .
d. d. d. d. d. d. d. d.
11) Which of the following is allowed under the applicable fees and charges when
d. d. d. d. d. d. d. d. d. d. d. d.
charging for a copy of medical records? - Correct Answer-Labor cost
d. d. d. d. d. d. d. d. d. d. d. d.
12) if a patient put in a request for an amendment to his or her medical record on July
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.20, 2020, when would be the last possible day that the CE would need to provide
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.outcome information on the amendment or notification of a 30-day extension? -
d. d. d. d. d. d. d. d. d. d. d.
d.Correct Answer-September 20, 2020 d. d. d. d.
13) If a patient chooses to make a complaint against a CE to the Secretary of Health
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.and Human Services, the complaint must be made in _____ days from the date
d. d. d. d. d. d. d. d. d. d. d. d. d.
d.the complaint was known or should have been known. - Correct Answer-180
d. d. d. d. d. d. d. d. d. d. d. d.
14) A patient made a request for an accounting of disclosure on March 31, 2020.
d. d. d. d. d. d. d. d. d. d. d. d. d.
What is the date range that must be provided on the accounting-of-disclosure
d. d. d. d. d. d. d. d. d. d. d. d.
document? - Correct Answer-March 31, 2015 -March 31, 2020. 6 years prior.
d. d. d. d. d. d. d. d. d. d. d. d. d.
15) What was the compliance date for all covered entities and business associates to
d. d. d. d. d. d. d. d. d. d. d. d.
bring all of the grandfathered business associate agreements into compliance with
d. d. d. d. d. d. d. d. d. d. d.
the final Omnibus Rule of 2013? - Correct Answer-September 23, 2014
d. d. d. d. d. d. d. d. d. d. d. d.
16) The HIPAA Security Rule allows flexibility with implementation based on
d. d. d. d. d. d. d. d. d.
reasonableness and appropriateness safeguards. This means that covered entities
d. d. d. d. d. d. d. d. d.
can - Correct Answer-implement based on organizational assessment
d. d. d. d. d. d. d. d. d.
17) What group was granted authority to bring civil actions against healthcare
d. d. d. d. d. d. d. d. d. d.
organizations and business associates based on alleged HIPAA violations? -
d. d. d. d. d. d. d. d. d. d.
Correct Answer-State attorney general
d. d. d. d. d.
, 18) To place a patient in a facility directory, a covered entity - Correct Answer-must
d. d. d. d. d. d. d. d. d. d. d. d. d.
obtain the patient's verbal agreement.
d. d. d. d. d. d.
19) The Privacy Rule permits charging patients for labor and supply costs associated
d. d. d. d. d. d. d. d. d. d. d.
with copying health records. Hospital is located in a state where state law allows
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
charging a patients a $100 search fee associated with locating records that have
d. d. d. d. d. d. d. d. d. d. d. d. d.
been requested. - Correct Answer-The Privacy Rule will preempt state law in
d. d. d. d. d. d. d. d. d. d. d. d.
this situation.
d. d. d.
20) What does it mean to state the regulation in the HIPAA Security Rule is
d. d. d. d. d. d. d. d. d. d. d. d. d.
addressable? - Correct Answer-The organization can implement an alternate
d. d. d. d. d. d. d. d. d.
safeguard of equivalent protections.
d. d. d. d. d.
21) A healthcare provider that provided a copy of an individual's medical record to a
d. d. d. d. d. d. d. d. d. d. d. d. d.
nursing home that the patient will be transferred to is an example of using
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
protected health information for what purpose? - Correct Answer-Treatment
d. d. d. d. d. d. d. d. d. d.
22) A payment from a drug company to a covered entity to promote a new
d. d. d. d. d. d. d. d. d. d. d. d. d.
medication for treatment of acne is referred to as - Correct Answer-direct.
d. d. d. d. d. d. d. d. d. d. d. d. d.
23) Which of the following is considered to be part of healthcare operations and uses
d. d. d. d. d. d. d. d. d. d. d. d. d.
deidentified health information pr a limited data set and benefits the covered
d. d. d. d. d. d. d. d. d. d. d. d.
entity? - Correct Answer-Fundraising
d. d. d. d. d.
24) Providing a copy of an emergency room visit report to a primary care provider is
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
an example of which of the following under HIPAA? - Correct Answer-
d. d. d. d. d. d. d. d. d. d. d. d.
Disclosure of protected health information d. d. d. d.
25) Authorizations are required for all disclosures except - Correct Answer- d. d. d. d. d. d. d. d. d.
Treatment, payment, and healthcare operations d. d. d. d. d.
26) Which of the following terms refers to the direct or indirect payment from a
d. d. d. d. d. d. d. d. d. d. d. d. d.
third party whose product or service is being described by the covered entity? -
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
Correct Answer-Financial remuneration
d. d. d.
27) A health plan uses a month's worth of diagnosis codes from member;s bills
d. d. d. d. d. d. d. d. d. d. d. d.
submitted to evaluate new services that can be created to support health-plan
d. d. d. d. d. d. d. d. d. d. d. d.
member education. This is an example of using protected health information for
d. d. d. d. d. d. d. d. d. d. d. d.
what purpose? - Correct Answer-Healthcare operations
d. d. d. d. d. d. d.
(CHPS) EXAM QUESTIONS WITH 100% CORRECT
ANSWERS.
1) Which of the following is a goal of the minimum necessary requirement under the
d. d. d. d. d. d. d. d. d. d. d. d. d.
HIPAA Privacy Rule? - Correct Answer-Ensure that all workforce members have
d. d. d. d. d. d. d. d. d. d. d.
the same access to PHI within an organization
d. d. d. d. d. d. d. d. d.
2) A patient is checking in at the registration desk and overhears a conversation
d. d. d. d. d. d. d. d. d. d. d. d.
between another patient and the billing specialist regarding a specific diagnosis
d. d. d. d. d. d. d. d. d. d. d.
that is not being covered under the patient's insurance. This is an example of
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
what type of disclosure? - Correct Answer-Incidental
d. d. d. d. d. d. d. d.
3) Which of the following is the only scenario where breach notification can be
d. d. d. d. d. d. d. d. d. d. d. d.
delayed past the 60-day notification requirement? - Correct Answer-When law
d. d. d. d. d. d. d. d. d. d.
enforcement requests a delay due to open criminal investigation.
d. d. d. d. d. d. d. d. d. d.
4) During a recent change in a computer system's access, an organization
d. d. d. d. d. d. d. d. d. d.
determined that they were going to create role-based access defined on the need
d. d. d. d. d. d. d. d. d. d. d. d. d.
for each job type within the organization. This is an example of application of
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
which of the following: - Correct Answer-Minimum necessary
d. d. d. d. d. d. d. d. d.
5) An organization just finished updating the minimum necessary policy and
d. d. d. d. d. d. d. d. d.
procedure. The new policy took effect on February 12, 2016. How long do they
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
have to maintain the previous version of the policy? - Correct Answer-February
d. d. d. d. d. d. d. d. d. d. d. d.
12, 2020
d. d. d.
6) Which of the following is considered a patient's right under the HIPAA Privacy
d. d. d. d. d. d. d. d. d. d. d. d.
Rule? - Correct Answer-Accounting of disclosure (AOD)
d. d. d. d. d. d. d. d.
7) How long does a covered entity have to respond to an accounting of disclosure
d. d. d. d. d. d. d. d. d. d. d. d. d.
request? - Correct Answer-30 days with one 30 day extension.
d. d. d. d. d. d. d. d. d. d. d.
8) A patient has requested three accounting-of-disclosures reports in the past
d. d. d. d. d. d. d. d. d.
month. Which of the following statements is true regarding the accounting of
d. d. d. d. d. d. d. d. d. d. d. d.
disclosure? - Correct Answer-The CE is allowed to charge a reasonable, cost-
d. d. d. d. d. d. d. d. d. d. d. d.
, based fee for the second and third request for accounting disclosures and must
d. d. d. d. d. d. d. d. d. d. d. d.
inform the patient prior.
d. d. d. d. d.
9) In the final HIPAA Omnibus Rule of 2013, which of the following was added to
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
the regulations regarding patient access? - Correct Answer-A patient has a right
d. d. d. d. d. d. d. d. d. d. d. d.
to receive his or her designated record set electronically, if maintained
d. d. d. d. d. d. d. d. d. d. d.
electronically.
d. d.
10) If a state requires that all medical records are disclosed within 15 days from the
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.request, and HIPAA requires for disclosures to be completed within 30 days
d. d. d. d. d. d. d. d. d. d. d.
d.from the request, which timeline should be followed? - Correct Answer-State
d. d. d. d. d. d. d. d. d. d.
d.law because it is more stringent than HIPAA .
d. d. d. d. d. d. d. d.
11) Which of the following is allowed under the applicable fees and charges when
d. d. d. d. d. d. d. d. d. d. d. d.
charging for a copy of medical records? - Correct Answer-Labor cost
d. d. d. d. d. d. d. d. d. d. d. d.
12) if a patient put in a request for an amendment to his or her medical record on July
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.20, 2020, when would be the last possible day that the CE would need to provide
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.outcome information on the amendment or notification of a 30-day extension? -
d. d. d. d. d. d. d. d. d. d. d.
d.Correct Answer-September 20, 2020 d. d. d. d.
13) If a patient chooses to make a complaint against a CE to the Secretary of Health
d. d. d. d. d. d. d. d. d. d. d. d. d. d. d.
d.and Human Services, the complaint must be made in _____ days from the date
d. d. d. d. d. d. d. d. d. d. d. d. d.
d.the complaint was known or should have been known. - Correct Answer-180
d. d. d. d. d. d. d. d. d. d. d. d.
14) A patient made a request for an accounting of disclosure on March 31, 2020.
d. d. d. d. d. d. d. d. d. d. d. d. d.
What is the date range that must be provided on the accounting-of-disclosure
d. d. d. d. d. d. d. d. d. d. d. d.
document? - Correct Answer-March 31, 2015 -March 31, 2020. 6 years prior.
d. d. d. d. d. d. d. d. d. d. d. d. d.
15) What was the compliance date for all covered entities and business associates to
d. d. d. d. d. d. d. d. d. d. d. d.
bring all of the grandfathered business associate agreements into compliance with
d. d. d. d. d. d. d. d. d. d. d.
the final Omnibus Rule of 2013? - Correct Answer-September 23, 2014
d. d. d. d. d. d. d. d. d. d. d. d.
16) The HIPAA Security Rule allows flexibility with implementation based on
d. d. d. d. d. d. d. d. d.
reasonableness and appropriateness safeguards. This means that covered entities
d. d. d. d. d. d. d. d. d.
can - Correct Answer-implement based on organizational assessment
d. d. d. d. d. d. d. d. d.
17) What group was granted authority to bring civil actions against healthcare
d. d. d. d. d. d. d. d. d. d.
organizations and business associates based on alleged HIPAA violations? -
d. d. d. d. d. d. d. d. d. d.
Correct Answer-State attorney general
d. d. d. d. d.
, 18) To place a patient in a facility directory, a covered entity - Correct Answer-must
d. d. d. d. d. d. d. d. d. d. d. d. d.
obtain the patient's verbal agreement.
d. d. d. d. d. d.
19) The Privacy Rule permits charging patients for labor and supply costs associated
d. d. d. d. d. d. d. d. d. d. d.
with copying health records. Hospital is located in a state where state law allows
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
charging a patients a $100 search fee associated with locating records that have
d. d. d. d. d. d. d. d. d. d. d. d. d.
been requested. - Correct Answer-The Privacy Rule will preempt state law in
d. d. d. d. d. d. d. d. d. d. d. d.
this situation.
d. d. d.
20) What does it mean to state the regulation in the HIPAA Security Rule is
d. d. d. d. d. d. d. d. d. d. d. d. d.
addressable? - Correct Answer-The organization can implement an alternate
d. d. d. d. d. d. d. d. d.
safeguard of equivalent protections.
d. d. d. d. d.
21) A healthcare provider that provided a copy of an individual's medical record to a
d. d. d. d. d. d. d. d. d. d. d. d. d.
nursing home that the patient will be transferred to is an example of using
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
protected health information for what purpose? - Correct Answer-Treatment
d. d. d. d. d. d. d. d. d. d.
22) A payment from a drug company to a covered entity to promote a new
d. d. d. d. d. d. d. d. d. d. d. d. d.
medication for treatment of acne is referred to as - Correct Answer-direct.
d. d. d. d. d. d. d. d. d. d. d. d. d.
23) Which of the following is considered to be part of healthcare operations and uses
d. d. d. d. d. d. d. d. d. d. d. d. d.
deidentified health information pr a limited data set and benefits the covered
d. d. d. d. d. d. d. d. d. d. d. d.
entity? - Correct Answer-Fundraising
d. d. d. d. d.
24) Providing a copy of an emergency room visit report to a primary care provider is
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
an example of which of the following under HIPAA? - Correct Answer-
d. d. d. d. d. d. d. d. d. d. d. d.
Disclosure of protected health information d. d. d. d.
25) Authorizations are required for all disclosures except - Correct Answer- d. d. d. d. d. d. d. d. d.
Treatment, payment, and healthcare operations d. d. d. d. d.
26) Which of the following terms refers to the direct or indirect payment from a
d. d. d. d. d. d. d. d. d. d. d. d. d.
third party whose product or service is being described by the covered entity? -
d. d. d. d. d. d. d. d. d. d. d. d. d. d.
Correct Answer-Financial remuneration
d. d. d.
27) A health plan uses a month's worth of diagnosis codes from member;s bills
d. d. d. d. d. d. d. d. d. d. d. d.
submitted to evaluate new services that can be created to support health-plan
d. d. d. d. d. d. d. d. d. d. d. d.
member education. This is an example of using protected health information for
d. d. d. d. d. d. d. d. d. d. d. d.
what purpose? - Correct Answer-Healthcare operations
d. d. d. d. d. d. d.
