HCCA - CHPC Study Questions (MASTER FLASHCARDS) Final EXAM
LATEST GRADED A NEW VERSION
What is the purpose of HIPAA? - CORRECT ANSWER • Protect PHI from unauthorized
disclosure/use;
• Prevent fraud, waste and abuse (via Administrative Simplification);
• Make health insurance portable under ERISA;
• Move health care onto a nationally standardized electronic billing platform
Ref. https://quizlet.com/6202453/hcca-chpc-overview-flash-cards/
More on HIPAA: https://www.hhs.gov/hipaa/index.html
HIPAA resides in which CFR section? - CORRECT ANSWER 45 CFR sections 164.102 through
164.534
How long does the Privacy Rule state that a practice or covered entity needs to retain medical
records?
a. Five years
b. Not stated
c. Six years
d. Seven years - CORRECT ANSWER b. Not stated
The Privacy Rule does not include medical record retention requirements and covered entities
may destroy such records at the time permitted by state or other applicable law.
Note: practice question from AAPC CPCO Ch5
The Privacy Rule does not restrict the use or disclosure of _______________, which neither
identifies nor provides a reasonable basis to identify an individual.
a. non-protected health information (non-PHI)
,b. reverse PHI
c. regulated PHI
d. de-identified health information - CORRECT ANSWER d. de-identified health information.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html
Protected health information (PHI) is considered de-identified by HIPAA Privacy Rule standards
by:
a. absence of actual knowledge by the covered entity that the remaining information could be
used alone or in combination with other information to identify the individual
b. removal of only patient name and date of birth
c. a formal determination by a qualified expert
d. the removal of 18 specified individual identifiers
e. A, C and D
f. All of the answers - CORRECT ANSWER e. A, C and D
The Privacy Rule provides two de-identification methods: 1) a formal determination by a
qualified expert; or 2) the removal of specified individual identifiers as well as absence of actual
knowledge by the covered entity that the remaining information could be used alone or in
combination with other information to identify the individual.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html#preparation
The HIPAA Privacy Rule covers:
a. Health plans
b. Health care clearinghouses
c. Health care providers who conduct certain financial and administrative transactions
electronically.
d. Life insurance companies
,e. A, B and C only - CORRECT ANSWER e. A, B and C only
Collectively, the rule covers only "Covered Entities". It does not cover or regulate employers, life
insurance companies, or public agencies that deliver social security or welfare benefits.
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-
privacy-standards/index.html
True or False:
The Privacy Rule generally requires covered entities to take reasonable steps to limit uses,
disclosures, or requests (if the request is to another covered entity) of protected health
information (PHI) to the minimum necessary to accomplish the intended purpose, known as the
minimum necessary standard. - CORRECT ANSWER TRUE
Ref. Minimum Necessary Requirement 45 CFR 164.502(b), 164.514(d)
True or False:
The HIPAA Privacy Rule does not restrict pharmacists to give advice about over-the-counter
medicines to customers. - CORRECT ANSWER TRUE
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/treatment-disclosures/index.html or See
45 CFR 164.502(a)(1)(i).
A health care provider wants to disclose protected health information (PHI) about a student to a
school nurse or physician. Does the HIPAA Privacy Rule allow this?
Yes. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students
to school nurses, physicians, or other health care providers for treatment purposes, without the
authorization of the student or student's parent.
OR
No. The HIPAA Privacy Rule mandates parental consent in this case. - CORRECT ANSWER Yes!
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/ferpa-and-hipaa/index.html
, True or False:
The HIPAA Privacy Rule applies to all forms of patients' protected health information, whether
electronic, written, or oral. In contrast, the Security Rule covers only protected health
information that is in electronic form. - CORRECT ANSWER TRUE
https://www.hhs.gov/hipaa/for-professionals/faq/2010/does-the-security-rule-apply-to-
written-and-oral-communications/index.html
The HIPAA Privacy Rule retraining of workforce
a. After a material change in policy
b. 6 months after initial training
c. Every other year
d. After violation - CORRECT ANSWER a. After a material change in policy
In developing a privacy monitoring plan, a privacy professional should initially focus on:
a. Discussion with the business owners
b. Presentation to the BOD
c. Reviewing disciplinary actions
d. Implementing mitigating activities - CORRECT ANSWER a. Discussion with the business
owners
An agency investigating a complaint of a HIPAA privacy violation contacts the facility for patient
information. The facility's policy should be to disclose all information:
a. If a search warrant is presented
b. That is required by state law
c. If the patients have been informed
d. Requested except for PHI - CORRECT ANSWER b. That is required by state law
Which of the following privacy laws relates to protection of financial information?
LATEST GRADED A NEW VERSION
What is the purpose of HIPAA? - CORRECT ANSWER • Protect PHI from unauthorized
disclosure/use;
• Prevent fraud, waste and abuse (via Administrative Simplification);
• Make health insurance portable under ERISA;
• Move health care onto a nationally standardized electronic billing platform
Ref. https://quizlet.com/6202453/hcca-chpc-overview-flash-cards/
More on HIPAA: https://www.hhs.gov/hipaa/index.html
HIPAA resides in which CFR section? - CORRECT ANSWER 45 CFR sections 164.102 through
164.534
How long does the Privacy Rule state that a practice or covered entity needs to retain medical
records?
a. Five years
b. Not stated
c. Six years
d. Seven years - CORRECT ANSWER b. Not stated
The Privacy Rule does not include medical record retention requirements and covered entities
may destroy such records at the time permitted by state or other applicable law.
Note: practice question from AAPC CPCO Ch5
The Privacy Rule does not restrict the use or disclosure of _______________, which neither
identifies nor provides a reasonable basis to identify an individual.
a. non-protected health information (non-PHI)
,b. reverse PHI
c. regulated PHI
d. de-identified health information - CORRECT ANSWER d. de-identified health information.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html
Protected health information (PHI) is considered de-identified by HIPAA Privacy Rule standards
by:
a. absence of actual knowledge by the covered entity that the remaining information could be
used alone or in combination with other information to identify the individual
b. removal of only patient name and date of birth
c. a formal determination by a qualified expert
d. the removal of 18 specified individual identifiers
e. A, C and D
f. All of the answers - CORRECT ANSWER e. A, C and D
The Privacy Rule provides two de-identification methods: 1) a formal determination by a
qualified expert; or 2) the removal of specified individual identifiers as well as absence of actual
knowledge by the covered entity that the remaining information could be used alone or in
combination with other information to identify the individual.
Ref. https://www.hhs.gov/hipaa/for-professionals/privacy/special-topics/de-
identification/index.html#preparation
The HIPAA Privacy Rule covers:
a. Health plans
b. Health care clearinghouses
c. Health care providers who conduct certain financial and administrative transactions
electronically.
d. Life insurance companies
,e. A, B and C only - CORRECT ANSWER e. A, B and C only
Collectively, the rule covers only "Covered Entities". It does not cover or regulate employers, life
insurance companies, or public agencies that deliver social security or welfare benefits.
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/190/who-must-comply-with-hipaa-
privacy-standards/index.html
True or False:
The Privacy Rule generally requires covered entities to take reasonable steps to limit uses,
disclosures, or requests (if the request is to another covered entity) of protected health
information (PHI) to the minimum necessary to accomplish the intended purpose, known as the
minimum necessary standard. - CORRECT ANSWER TRUE
Ref. Minimum Necessary Requirement 45 CFR 164.502(b), 164.514(d)
True or False:
The HIPAA Privacy Rule does not restrict pharmacists to give advice about over-the-counter
medicines to customers. - CORRECT ANSWER TRUE
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/treatment-disclosures/index.html or See
45 CFR 164.502(a)(1)(i).
A health care provider wants to disclose protected health information (PHI) about a student to a
school nurse or physician. Does the HIPAA Privacy Rule allow this?
Yes. The HIPAA Privacy Rule allows covered health care providers to disclose PHI about students
to school nurses, physicians, or other health care providers for treatment purposes, without the
authorization of the student or student's parent.
OR
No. The HIPAA Privacy Rule mandates parental consent in this case. - CORRECT ANSWER Yes!
Ref. https://www.hhs.gov/hipaa/for-professionals/faq/ferpa-and-hipaa/index.html
, True or False:
The HIPAA Privacy Rule applies to all forms of patients' protected health information, whether
electronic, written, or oral. In contrast, the Security Rule covers only protected health
information that is in electronic form. - CORRECT ANSWER TRUE
https://www.hhs.gov/hipaa/for-professionals/faq/2010/does-the-security-rule-apply-to-
written-and-oral-communications/index.html
The HIPAA Privacy Rule retraining of workforce
a. After a material change in policy
b. 6 months after initial training
c. Every other year
d. After violation - CORRECT ANSWER a. After a material change in policy
In developing a privacy monitoring plan, a privacy professional should initially focus on:
a. Discussion with the business owners
b. Presentation to the BOD
c. Reviewing disciplinary actions
d. Implementing mitigating activities - CORRECT ANSWER a. Discussion with the business
owners
An agency investigating a complaint of a HIPAA privacy violation contacts the facility for patient
information. The facility's policy should be to disclose all information:
a. If a search warrant is presented
b. That is required by state law
c. If the patients have been informed
d. Requested except for PHI - CORRECT ANSWER b. That is required by state law
Which of the following privacy laws relates to protection of financial information?
