HIPAA TEST REVIEW Q&A

HIPAA TEST REVIEW Q&A
HIPAA - Answer-The Health Insurance Portability and Accountability Act

Portions of HIPAA most important for us - Answer-protecting the privacy and security of
health data

PHI - Answer-protected health information - any info that is created or received by a
health care provider, health plan, or health care clearinghouse that relates to or
describes the past, present, or future physical or mental health condition of an individual
or past, present, or future payment for the provision of healthcare to the individual, and
that can be used to identify the individual.

Types of data protected by HIPAA - Answer-written documentation, paper records,
medicine labels, ID bracelets, spoken and verbal info including voicemail, electronic
databases, photographs, digital images

18 identifiers that are considered PHI - Answer-1. name
2. geographic subdivisions smaller than a state
3. all elements of date (except year)
4. telephone numbers
5. fax numbers
6. electronic mail address
7. social security number
8. medical record numbers
9. health plan beneficiary numbers
10. account numbers
11. certificate/license numbers
12. vehicle identifies and serial numbers
13. device identifiers
14. URLs
15. IP addresses
16. biometric identifiers
17. full face images
18. any other unique identifying number

All ages over _____ are indicative of age according to PHI - Answer-89

Any one of the 18 identifiers combined with ______ is PHI - Answer-a reference to a
diagnosis or medical condition

Which Department through the Office for Civil Rights enforces civil monetary penalties
for noncompliance with HIPAA - Answer-Department of Health and Human Services

HIPAA civil penalties include fines from ___ to ____ - Answer-$100 to $1.5 million

, True or False - HIPAA penalties and fines only apply to covered entities - Answer-
FALSE - Penalties and fines apply to members of the work force and other individuals,
NOT just to the covered entities.

In addition, members of the UAB/UABHS work force are subject to what kind of
disciplinary action? - Answer-up to and including termination of employment for
noncompliance with HIPAA privacy and security regulations and standards

Privacy - Answer-an individual's right to keep certain information to himself or herself,
with the understanding that their protected health information (PHI) will only be used or
disclosed with their permission or as permitted by law.

What are privacy core standards? - Answer-Privacy core standards govern how
UAB/UABHS and its workforce shall operate in order to meet the HIPAA Privacy Rule.
In particular:1) Use and Disclosure of Dealth Information2) Use and Disclosure of
Health Information for Marketing3) Use and Disclosure of Health Information for
Fundraising4) Use and Disclosure of Identifiable Health Information for Research5)
Patient Health Information Rights

HIPAA states that PHI may be used and disclosed to facilitate - Answer-treatment,
payment, and healthcare operations(TPO)

True or False - PHI may always be disclosed to individuals involved in a patient's care
or payment for care - Answer-FALSE - not if a patient objects

When HIPAA permits use or disclosure of PHI, a covered entity must use of disclose
only the ________ PHI required to accomplish the purpose of the use or disclosure. -
Answer-minimum necessary

The only expectations to the minimum necessary standard are those times when a
covered entity is disclosing PHI for the following reasons: - Answer-1) Treatment
2) Purposes for which a patient authorization is signed
3) Disclosures required by law
4) Sharing information to the patient about himself/herself

True or False - You can use your access to look up your own medical information or
information on your family, friends, or co-workers. - Answer-FALSE

True or False- It is okay to discuss PHI outside of work or with other employees who do
not need to know the information to perform their jobs as long as they do not tell. -
Answer-False. Do not discuss PHI outside of work or with other employees who do not
need to know the information to perform their jobs

What is required before a covered entity can contract a third party individual or vendor
(subcontractor) to perform activities or functions which will involve the use or disclosure
of the covered entity's PHI. - Answer-A Business Associate Agreement (BAA)