"HCCA – CHPC Certification Exam 2024 | 50
Privacy Compliance Practice Questions with
Rationales | HIPAA, Breach, Risk, Training"
Which of the following uses of patient health information do not require the patient's
authorization?
a. Treatment, payment, health care administration (TPO)
b. Marketing
c. Genetic testing and research studies
d. Release of psychotherapy notes ✔✔answer✔✔a. TPO
Which of the following are considered protected health information under HIPAA?
a. Phone number
b. Medical record number
c. License plate number
d. Email address
e. all of the above ✔✔answer✔✔e. all of the above
HIPAA rules do not require providers to grant patient access to which of the following types of
information?
a. Accounting disclosures
b. Office visit documentation
c. Psychotherapy notes
d. Medication list ✔✔answer✔✔c. Psychotherapy notes
,Government agencies also have limits on other information they may collect about individuals.
The _______ Act limits and/or restricts the sharing of information between government
agencies.
a. Freedom of Information
b. Privacy
c. HIPAA
d. Omnibus ✔✔answer✔✔b. Privacy
The "Notice of Privacy Practices" explains the ways the practice will use patient information and
describes patients' rights regarding their information.
a. True
b. False ✔✔answer✔✔a. True
45 CFR 164.520(b)(1)(iv)
There are three things that a practice must do regarding communicating with the patient about
privacy practices and procedures, except for one of the following:
a. Give every patient a notice describing the physician office privacy practices
b. Make a "good faith" effort to obtain the patient's written acknowledgment of receiving the
notice
c. Obtain the patient's authorization for disclosures or uses not covered by the "Notice of
Privacy Practices"
d. Give every patient a copy of his or her medical record ✔✔answer✔✔d. Give every patient a
copy of his or her medical record
Which government agency(ies) issues Certificates of Confidentiality to protect the privacy of
subjects enrolled in sensitive biomedical, behavioral, clinical, or other research. Select all that
apply.
,a. Office of Civil Rights
b. Food and Drug Administration
c. Occupational Safety and Health Administration
d. National Institutes of Health
e. Office for Human Research Protections ✔✔answer✔✔b. and d. (FDA and NIH)
Sign-in sheets include protected health information. However, they may be used without
violating privacy rules for this reason:
a. Patient name is not protected health information
b. The sign-in sheet is used for health care operations and is considered an incidental disclosure
c. The patient name is usually not legible
d. Not all persons signing the sheet are patients ✔✔answer✔✔b. The sign-in sheet is used for
health care operations and is considered an incidental disclosure
The rights of individual patients under HIPAA rules cover their access to their information and its
disclosure to others. Which of the following is not a patient right under HIPAA rules?
a. To inspect and copy his or her health information
b. To request changes to his or her records
c. To obtain an accounting of disclosures of his or her information
d. To inspect the protected health information of his or her spouse ✔✔answer✔✔d. To inspect
the protected health information of his or her spouse
When must the patient authorize the use or disclosure of health information?
a. At every visit
b. Only when the information will be provided to law enforcement
c. Only when used for purposes other than treatment, day-to-day operations, or to comply with
a request to which the practice is legally obligated to respond
, d. Only in emergency situations ✔✔answer✔✔c. Only when used for purposes other than
treatment, day-to-day operations, or to comply with a request to which the practice is legally
obligated to respond
HIPAA rules and regulations cover what kind of information?
a. All personal health information in any format, for any person
b. Protected health information held or transmitted by a covered entity or its business
associate, in any form or media, whether electronic, paper, or oral
c. Diagnoses and procedure information
d. All health information for persons who have insurance ✔✔answer✔✔b. Protected health
information held or transmitted by a covered entity or its business associate, in any form or
media, whether electronic, paper, or oral
Under what circumstances are employees allowed to repeat to others PHI that is heard or seen
on the job?
a. Only when authorized for their job duties
b. Once they have been terminated
c. After a patient dies
d. If they do not think the patient would mind ✔✔answer✔✔a. Only when authorized for their
job duties
What should an employee do when he or she suspects another employee is in violation of the
privacy or security policies?
a. Gather solid evidence against the person
b. Confront the individual and tell the person that he or she is violating the rules
c. Nothing
d. Report suspicions to the office manager, privacy/security officer, or other designated person
✔✔answer✔✔d. Report suspicions to the office manager, privacy/security officer, or other
designated person
Privacy Compliance Practice Questions with
Rationales | HIPAA, Breach, Risk, Training"
Which of the following uses of patient health information do not require the patient's
authorization?
a. Treatment, payment, health care administration (TPO)
b. Marketing
c. Genetic testing and research studies
d. Release of psychotherapy notes ✔✔answer✔✔a. TPO
Which of the following are considered protected health information under HIPAA?
a. Phone number
b. Medical record number
c. License plate number
d. Email address
e. all of the above ✔✔answer✔✔e. all of the above
HIPAA rules do not require providers to grant patient access to which of the following types of
information?
a. Accounting disclosures
b. Office visit documentation
c. Psychotherapy notes
d. Medication list ✔✔answer✔✔c. Psychotherapy notes
,Government agencies also have limits on other information they may collect about individuals.
The _______ Act limits and/or restricts the sharing of information between government
agencies.
a. Freedom of Information
b. Privacy
c. HIPAA
d. Omnibus ✔✔answer✔✔b. Privacy
The "Notice of Privacy Practices" explains the ways the practice will use patient information and
describes patients' rights regarding their information.
a. True
b. False ✔✔answer✔✔a. True
45 CFR 164.520(b)(1)(iv)
There are three things that a practice must do regarding communicating with the patient about
privacy practices and procedures, except for one of the following:
a. Give every patient a notice describing the physician office privacy practices
b. Make a "good faith" effort to obtain the patient's written acknowledgment of receiving the
notice
c. Obtain the patient's authorization for disclosures or uses not covered by the "Notice of
Privacy Practices"
d. Give every patient a copy of his or her medical record ✔✔answer✔✔d. Give every patient a
copy of his or her medical record
Which government agency(ies) issues Certificates of Confidentiality to protect the privacy of
subjects enrolled in sensitive biomedical, behavioral, clinical, or other research. Select all that
apply.
,a. Office of Civil Rights
b. Food and Drug Administration
c. Occupational Safety and Health Administration
d. National Institutes of Health
e. Office for Human Research Protections ✔✔answer✔✔b. and d. (FDA and NIH)
Sign-in sheets include protected health information. However, they may be used without
violating privacy rules for this reason:
a. Patient name is not protected health information
b. The sign-in sheet is used for health care operations and is considered an incidental disclosure
c. The patient name is usually not legible
d. Not all persons signing the sheet are patients ✔✔answer✔✔b. The sign-in sheet is used for
health care operations and is considered an incidental disclosure
The rights of individual patients under HIPAA rules cover their access to their information and its
disclosure to others. Which of the following is not a patient right under HIPAA rules?
a. To inspect and copy his or her health information
b. To request changes to his or her records
c. To obtain an accounting of disclosures of his or her information
d. To inspect the protected health information of his or her spouse ✔✔answer✔✔d. To inspect
the protected health information of his or her spouse
When must the patient authorize the use or disclosure of health information?
a. At every visit
b. Only when the information will be provided to law enforcement
c. Only when used for purposes other than treatment, day-to-day operations, or to comply with
a request to which the practice is legally obligated to respond
, d. Only in emergency situations ✔✔answer✔✔c. Only when used for purposes other than
treatment, day-to-day operations, or to comply with a request to which the practice is legally
obligated to respond
HIPAA rules and regulations cover what kind of information?
a. All personal health information in any format, for any person
b. Protected health information held or transmitted by a covered entity or its business
associate, in any form or media, whether electronic, paper, or oral
c. Diagnoses and procedure information
d. All health information for persons who have insurance ✔✔answer✔✔b. Protected health
information held or transmitted by a covered entity or its business associate, in any form or
media, whether electronic, paper, or oral
Under what circumstances are employees allowed to repeat to others PHI that is heard or seen
on the job?
a. Only when authorized for their job duties
b. Once they have been terminated
c. After a patient dies
d. If they do not think the patient would mind ✔✔answer✔✔a. Only when authorized for their
job duties
What should an employee do when he or she suspects another employee is in violation of the
privacy or security policies?
a. Gather solid evidence against the person
b. Confront the individual and tell the person that he or she is violating the rules
c. Nothing
d. Report suspicions to the office manager, privacy/security officer, or other designated person
✔✔answer✔✔d. Report suspicions to the office manager, privacy/security officer, or other
designated person
