HIPAA Basics Exam with 100% Correct
Answers
Health Insurance Portability and Accountability Act (HIPAA) - ANS-was passed by
Congress in 1996 to protect patients' personal health information.
HIPAA is an acronym that stands for _____. - ANS-Health Insurance Portability and
Accountability Act
HIPAA provides for which of the following?
-portability of health insurance
-privacy of health information
-security of electronic health information
-all the above - ANS-all the above
established Minimum Necessary rule - ANS-Privacy Rule
What did the HITECH Act do?
-provided funding incentives to encourage the adoption of electronic health record
(EHR) systems
-increased the civil penalties for HIPAA violations
-gave state Attorneys General the authority to enforce HIPAA civil penalties
-all the above - ANS-all the above
Which of the following is NOT part of HIPAA?
-the Privacy Rule
-the Patient Rule
-the Security Rule
-Administrative Simplification - ANS-the Patient Rule
Violating the Privacy Rule can result in _____.
-loss of your job
-a major fine
-going to jail
-all the above - ANS-all the above
Which section of HIPAA governs the confidentiality, integrity, and availability (CIA) of
electronic health information? - ANS-the Security Rule
Any company or group that pays for medical care is a healthcare provider. - ANS-False
, HIPAA includes both civil and criminal penalties for violations. - ANS-True
Prior to HIPAA, Medicare and insurance companies had unified electronic billing
formats and codes for medical diagnostics and treatment. - ANS-False
Criminal provisions are enforced by the U.S. Department of Justice. - ANS-True
The principle of Minimum Necessary - ANS-access guides all sharing of PHI. Only the
minimum amount of information needed to meet a legitimate purpose should be shared.
Policies should be written that limit access to patient data. Procedures should be
implemented to limit access to PHI based on organizational roles and responsibilities.
Authorized access under the Minimum Necessary requirements include: - ANS--
Disclosure to a healthcare provider for treatment
-Disclosure to the patient
-Disclosure that has been explicitly authorized by the patient
-Disclosure to HHS for compliance or enforcement
-Disclosure required by law enforcement, such as in suspected child abuse cases
-Disclosure required for HIPAA Transactions or Administrative Simplification
The HIPAA Privacy Rule went into effect in what year? - ANS-2003
A _____ must be provided to each patient informing them of their privacy rights, the
organization's security officer, and how to file a complaint. - ANS-Notice of Privacy
Practices
Patients may provide written authorization to share their records. - ANS-True
Suspected child abuse can only be reported with the patient's consent. - ANS-False
Various administrative safeguards that may be required in an organization. - ANS--
Security Management Process
-Assigned Security Responsibility
-Information Access Management
-Security Awareness & Training
-Security Incident Procedures
-Contingency Plan
-Testing and Revision Procedure
-Business Associates
-Workstation Use
Security Management Process - ANS--Risk analysis
-Risk management
-Sanction Policy
-Information System Activity Review
Answers
Health Insurance Portability and Accountability Act (HIPAA) - ANS-was passed by
Congress in 1996 to protect patients' personal health information.
HIPAA is an acronym that stands for _____. - ANS-Health Insurance Portability and
Accountability Act
HIPAA provides for which of the following?
-portability of health insurance
-privacy of health information
-security of electronic health information
-all the above - ANS-all the above
established Minimum Necessary rule - ANS-Privacy Rule
What did the HITECH Act do?
-provided funding incentives to encourage the adoption of electronic health record
(EHR) systems
-increased the civil penalties for HIPAA violations
-gave state Attorneys General the authority to enforce HIPAA civil penalties
-all the above - ANS-all the above
Which of the following is NOT part of HIPAA?
-the Privacy Rule
-the Patient Rule
-the Security Rule
-Administrative Simplification - ANS-the Patient Rule
Violating the Privacy Rule can result in _____.
-loss of your job
-a major fine
-going to jail
-all the above - ANS-all the above
Which section of HIPAA governs the confidentiality, integrity, and availability (CIA) of
electronic health information? - ANS-the Security Rule
Any company or group that pays for medical care is a healthcare provider. - ANS-False
, HIPAA includes both civil and criminal penalties for violations. - ANS-True
Prior to HIPAA, Medicare and insurance companies had unified electronic billing
formats and codes for medical diagnostics and treatment. - ANS-False
Criminal provisions are enforced by the U.S. Department of Justice. - ANS-True
The principle of Minimum Necessary - ANS-access guides all sharing of PHI. Only the
minimum amount of information needed to meet a legitimate purpose should be shared.
Policies should be written that limit access to patient data. Procedures should be
implemented to limit access to PHI based on organizational roles and responsibilities.
Authorized access under the Minimum Necessary requirements include: - ANS--
Disclosure to a healthcare provider for treatment
-Disclosure to the patient
-Disclosure that has been explicitly authorized by the patient
-Disclosure to HHS for compliance or enforcement
-Disclosure required by law enforcement, such as in suspected child abuse cases
-Disclosure required for HIPAA Transactions or Administrative Simplification
The HIPAA Privacy Rule went into effect in what year? - ANS-2003
A _____ must be provided to each patient informing them of their privacy rights, the
organization's security officer, and how to file a complaint. - ANS-Notice of Privacy
Practices
Patients may provide written authorization to share their records. - ANS-True
Suspected child abuse can only be reported with the patient's consent. - ANS-False
Various administrative safeguards that may be required in an organization. - ANS--
Security Management Process
-Assigned Security Responsibility
-Information Access Management
-Security Awareness & Training
-Security Incident Procedures
-Contingency Plan
-Testing and Revision Procedure
-Business Associates
-Workstation Use
Security Management Process - ANS--Risk analysis
-Risk management
-Sanction Policy
-Information System Activity Review
