LSU GEOL 1001 EXAM 1 Questions and Answers|
Updated| Pass Guaranteed
1. What is the primary purpose of the HIPAA Privacy Rule in an ROI setting?
A. To eliminate all access to PHI
B. To establish standards for protecting and using/disclosing PHI
C. To determine medical necessity for treatment
D. To establish hospital reimbursement rates
Correct Answer: B
Rationale: The HIPAA Privacy Rule establishes national standards governing the use and
disclosure of protected health information (PHI) and protects individuals' privacy rights. ROI
professionals use these requirements when evaluating requests.
2. The "minimum necessary" standard generally requires a covered entity to:
A. Release the entire medical record for every request
B. Limit PHI used or disclosed to what is reasonably necessary for the intended purpose
C. Refuse all third-party requests
D. Release only information written by physicians
Correct Answer: B
Rationale: Minimum necessary generally means limiting PHI use, disclosure, or request to the
minimum amount reasonably necessary to accomplish the intended purpose. The standard
does not apply to every HIPAA disclosure, such as disclosures to the individual.
3. Which request generally does NOT require application of the minimum necessary standard?
A. Request from a health plan for payment
B. Request from an employer
C. Patient requesting their own PHI
D. Request from a business associate
Correct Answer: C
Rationale: A patient's request for their own PHI is generally not subject to the minimum
necessary standard. The patient has a right of access to the PHI in the designated record set,
subject to applicable limitations.
,4. Which HIPAA rule primarily addresses electronic protected health information security?
A. Privacy Rule
B. Security Rule
C. Breach Notification Rule
D. Enforcement Rule
Correct Answer: B
Rationale: The HIPAA Security Rule establishes administrative, physical, and technical
safeguards for electronic PHI (ePHI).
5. Which is an example of a technical safeguard?
A. Employee training
B. Locked filing cabinet
C. Access controls for an electronic system
D. Written confidentiality agreement
Correct Answer: C
Rationale: Technical safeguards include technology-based measures such as access controls,
authentication, and audit controls that protect ePHI.
6. Which action best supports secure handling of ePHI?
A. Sharing passwords between ROI employees
B. Leaving an unlocked workstation unattended
C. Using individual user authentication
D. Sending PHI to any email address provided by a caller
Correct Answer: C
Rationale: Individual authentication helps ensure that users are properly identified and that
system access can be controlled and audited.
7. What is the purpose of the HIPAA Final Omnibus Rule?
,A. To eliminate the Privacy Rule
B. To strengthen and modify HIPAA requirements, including provisions related to business
associates and patient rights
C. To replace all state privacy laws
D. To eliminate breach notification requirements
Correct Answer: B
Rationale: The Final Omnibus Rule made significant changes to HIPAA, including strengthening
privacy and security requirements and expanding certain responsibilities of business associates.
8. A subpoena requests a patient's medical record. What should the ROI professional do first?
A. Immediately release the complete record
B. Ignore the subpoena
C. Determine whether applicable legal and HIPAA requirements for responding to the subpoena
have been satisfied
D. Contact the patient's employer
Correct Answer: C
Rationale: A subpoena does not automatically mean that the entire record should be released.
The ROI professional must evaluate the subpoena and applicable federal and state
requirements, including required assurances or protective measures.
9. What is a "quash period" associated with a subpoena?
A. A period during which a patient or party may challenge the subpoena
B. The time needed to scan records
C. The period for destroying records
D. The time required to bill the requester
Correct Answer: A
Rationale: A state or court-established quash period may provide an opportunity for an affected
party to challenge or object to a subpoena before records are released.
10. Why is it important for ROI staff to know both federal and state law?
, A. Federal law always overrides state law
B. State law can never apply to PHI
C. More stringent applicable state requirements may affect disclosure decisions
D. State law only applies to billing
Correct Answer: C
Rationale: HIPAA establishes a federal baseline, but applicable state laws can provide additional
protections. ROI professionals must determine which requirements apply to the particular
disclosure.
11. When federal and state requirements differ, the ROI professional should:
A. Automatically use whichever is easier
B. Determine which applicable requirement provides the required level of protection
C. Ignore state law
D. Always release the entire record
Correct Answer: B
Rationale: ROI decisions must account for applicable federal and state requirements. Legal
counsel or organizational compliance personnel may need to be consulted when requirements
conflict.
12. Which federal agency is primarily responsible for enforcing HIPAA Privacy and Security
Rules?
A. OCR
B. FDA
C. CDC
D. OSHA
Correct Answer: A
Rationale: The Office for Civil Rights (OCR) within HHS is responsible for enforcing HIPAA
privacy, security, and breach notification requirements.
13. What is the role of OCR in relation to patient rights?
Updated| Pass Guaranteed
1. What is the primary purpose of the HIPAA Privacy Rule in an ROI setting?
A. To eliminate all access to PHI
B. To establish standards for protecting and using/disclosing PHI
C. To determine medical necessity for treatment
D. To establish hospital reimbursement rates
Correct Answer: B
Rationale: The HIPAA Privacy Rule establishes national standards governing the use and
disclosure of protected health information (PHI) and protects individuals' privacy rights. ROI
professionals use these requirements when evaluating requests.
2. The "minimum necessary" standard generally requires a covered entity to:
A. Release the entire medical record for every request
B. Limit PHI used or disclosed to what is reasonably necessary for the intended purpose
C. Refuse all third-party requests
D. Release only information written by physicians
Correct Answer: B
Rationale: Minimum necessary generally means limiting PHI use, disclosure, or request to the
minimum amount reasonably necessary to accomplish the intended purpose. The standard
does not apply to every HIPAA disclosure, such as disclosures to the individual.
3. Which request generally does NOT require application of the minimum necessary standard?
A. Request from a health plan for payment
B. Request from an employer
C. Patient requesting their own PHI
D. Request from a business associate
Correct Answer: C
Rationale: A patient's request for their own PHI is generally not subject to the minimum
necessary standard. The patient has a right of access to the PHI in the designated record set,
subject to applicable limitations.
,4. Which HIPAA rule primarily addresses electronic protected health information security?
A. Privacy Rule
B. Security Rule
C. Breach Notification Rule
D. Enforcement Rule
Correct Answer: B
Rationale: The HIPAA Security Rule establishes administrative, physical, and technical
safeguards for electronic PHI (ePHI).
5. Which is an example of a technical safeguard?
A. Employee training
B. Locked filing cabinet
C. Access controls for an electronic system
D. Written confidentiality agreement
Correct Answer: C
Rationale: Technical safeguards include technology-based measures such as access controls,
authentication, and audit controls that protect ePHI.
6. Which action best supports secure handling of ePHI?
A. Sharing passwords between ROI employees
B. Leaving an unlocked workstation unattended
C. Using individual user authentication
D. Sending PHI to any email address provided by a caller
Correct Answer: C
Rationale: Individual authentication helps ensure that users are properly identified and that
system access can be controlled and audited.
7. What is the purpose of the HIPAA Final Omnibus Rule?
,A. To eliminate the Privacy Rule
B. To strengthen and modify HIPAA requirements, including provisions related to business
associates and patient rights
C. To replace all state privacy laws
D. To eliminate breach notification requirements
Correct Answer: B
Rationale: The Final Omnibus Rule made significant changes to HIPAA, including strengthening
privacy and security requirements and expanding certain responsibilities of business associates.
8. A subpoena requests a patient's medical record. What should the ROI professional do first?
A. Immediately release the complete record
B. Ignore the subpoena
C. Determine whether applicable legal and HIPAA requirements for responding to the subpoena
have been satisfied
D. Contact the patient's employer
Correct Answer: C
Rationale: A subpoena does not automatically mean that the entire record should be released.
The ROI professional must evaluate the subpoena and applicable federal and state
requirements, including required assurances or protective measures.
9. What is a "quash period" associated with a subpoena?
A. A period during which a patient or party may challenge the subpoena
B. The time needed to scan records
C. The period for destroying records
D. The time required to bill the requester
Correct Answer: A
Rationale: A state or court-established quash period may provide an opportunity for an affected
party to challenge or object to a subpoena before records are released.
10. Why is it important for ROI staff to know both federal and state law?
, A. Federal law always overrides state law
B. State law can never apply to PHI
C. More stringent applicable state requirements may affect disclosure decisions
D. State law only applies to billing
Correct Answer: C
Rationale: HIPAA establishes a federal baseline, but applicable state laws can provide additional
protections. ROI professionals must determine which requirements apply to the particular
disclosure.
11. When federal and state requirements differ, the ROI professional should:
A. Automatically use whichever is easier
B. Determine which applicable requirement provides the required level of protection
C. Ignore state law
D. Always release the entire record
Correct Answer: B
Rationale: ROI decisions must account for applicable federal and state requirements. Legal
counsel or organizational compliance personnel may need to be consulted when requirements
conflict.
12. Which federal agency is primarily responsible for enforcing HIPAA Privacy and Security
Rules?
A. OCR
B. FDA
C. CDC
D. OSHA
Correct Answer: A
Rationale: The Office for Civil Rights (OCR) within HHS is responsible for enforcing HIPAA
privacy, security, and breach notification requirements.
13. What is the role of OCR in relation to patient rights?
