Question 1

In the US, privacy protections for health information come from:

Accepted Answer

Privacy protections come from all of these sources - both federal and state law, as well as the requirements of private certification organizations.

Question 2

Privacy, in the health information context discussed here, refers to:

Accepted Answer

The rules about who can access health information, and under what circumstances.

Question 3

Under the federal HIPAA regulations, state health privacy laws:

Accepted Answer

Remain in effect if more stringent than what HIPAA provides.

Question 4

What kinds of persons and organizations are affected by HIPAA's requirements?

Accepted Answer

Health care providers, health plans, and health information clearinghouses, their business associates, and the workers for those organizations.

Question 5

HIPAA privacy protections cover identifiable personal information about the past, present or future physical or mental health condition. What does that include?

Accepted Answer

Health information in any form or medium, as long as it is identified (or identifiable) as a particular person's information.

Question 6

When patients receive a copy of an organization's Privacy Notice, they are asked to sign an acknowledgment. Why?

Accepted Answer

It shows they received it.

Question 7

Organizations covered by the federal HIPAA privacy law are expected to

Accepted Answer

Protect the health information under their control, train their workers in how to protect information, and help patients exercise their rights under the law.

Question 8

Which of these is not a right under HIPAA?

Accepted Answer

To control all disclosures of information in the health record.

Question 9

What does HIPAA's minimum necessary standard require of health care workers?

Accepted Answer

Use or disclose only the minimum necessary amount of health information to accomplish a task.

Question 10

HIPAA's incidental uses and disclosures provision excuses deviations from the minimum necessary standard. What is excused?

Accepted Answer

Truly accidental excess uses and disclosures, where reasonable caution was otherwise used and there was no negligence.

Question 11

When a privacy problem is discovered, which of the following is/are true?

Accepted Answer

All of the above

Question 12

HIPAA allows health care organizations to control many information decisions. But where the patient retains control, which of the following is/are true?

Accepted Answer

If a person has a right to make a health care decision, then he/she has a right to control information associated with that decision.

Question 13

With respect to permissions for uses and disclosures, HIPAA divides up health information into three categories. Into which category does information related to treatment, payment and health care operations go?

Accepted Answer

Uses or disclosures that generally require oral agreement only.

Question 14

With respect to permissions for uses and disclosures, HIPAA divides up health information into three categories. Into which category do discussions with family members go?

Accepted Answer

Uses or disclosures that require generally oral agreement only.

Question 15

With respect to permissions for uses and disclosures, HIPAA divides up health information into three categories. Into which category does information related to research, marketing and fundraising go?

Accepted Answer

Uses or disclosures that generally require specific written authorization.

Question 16

Which of the following are organizations required to do under HIPAA?

Accepted Answer

Appoint a Privacy Officer to administer HIPAA rules.

Question 17

HIPAA allows healthcare organizations to control many information decisions. However, where the patient retains control, which of the following is true?

Accepted Answer

If a person has a right to make a healthcare decision, then generally that person has a right to control information associated with the decision.

Question 18

Which of these is not generally a good practice for telephone use?

Accepted Answer

Using voicemail systems and answering machines that do not require a password or PIN for access.

Question 19

Which of these is not generally a good practice for fax machine use?

Accepted Answer

Sensitive faxes -- inbound or outbound -- are left sitting in or around the machine.

Question 20

Which of these is not a good practice for physical security?

Accepted Answer

To preserve good customer relations, visitors are generally allowed access to all areas of a facility unless it appears they are doing something suspicious.

Question 21

Which of these is generally not a good practice with respect to oral communications (that is, talking) in organizations like healthcare facilities?

Accepted Answer

Use of full names in public areas or on intercom/paging systems, because there is no security issue with identifying persons in public areas and using full names helps avoid misidentification.

Question 22

Information security's goals are sometimes described by the letters CIA. Which of the following is correct definition of C, I, or A?

Accepted Answer

All the above

Question 23

Which of the following is true?

Accepted Answer

Federal regulations include treatment-related uses and disclosures in a large category (along with payment and healthcare operations) that require no specific permission from patients.

Question 24

When a patient enters a clinical facility, they must inevitably surrender control of their information for a broad range of uses and disclosures. In the circumstances where the patient retains control of information, which of the following is true?

Accepted Answer

If the person controls a decision about treatment, he/she controls information about the information associated with it.

Question 25

Patients must be provided with federally-mandated Privacy Notices when they first encounter direct treatment providers. Which of the following is an implication of that for clinicians?

Accepted Answer

The provision of the notice just before receiving treatment means clinicians will receive some questions about privacy issues. There is an obligation to know the answers, or to be able to direct the patient to someone who does.

Question 26

Which of the following is true?

Accepted Answer

The minimum necessary standard applies to treatment-related uses, but not treatment-related disclosures, so as to avoid any interference with information exchanges among practitioners.

Question 27

Which category of health information does HIPAA extend extra protections, with a requirement for separate authorization?

Accepted Answer

Psychotherapy notes

Question 28

Which best describes the role of the clinician in managing privacy matters?

Accepted Answer

How clinicians handle information inevitably sets the tone for everyone else, so the example they set is critical.

Question 29

When required, the information provided to the data subject in a HIPAA disclosure accounting ...

Accepted Answer

must be more detailed for disclosures that involve fewer than 50 subject records.

Question 30

The HIPAA minimum necessary standard applies...

Accepted Answer

To all human subjects research that uses PHI without an authorization from the data subject.

Question 31

HIPAA protects a category of information known as protected health information (PHI). PHI covered under HIPAA includes:

Accepted Answer

Identifiable health information that is created or held by covered entities and their business associates.

Question 32

A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT:

Accepted Answer

Data that does not cross state lines when disclosed by the covered entity.

Question 33

If you're unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with:

Accepted Answer

An organizational IRB or Privacy Board, privacy official (Privacy Officer), or security official (Security Officer), depending on the issue.

Question 34

HIPAA includes in its definition of research, activities related to:

Accepted Answer

Development of generalizable knowledge.

Question 35

A HIPAA authorization has which of the following characteristics:

Accepted Answer

Uses plain language that the data subject can understand, similar to the requirement for an informed consent document.

Question 36

HIPAA's protections for health information used for research purposes...

Accepted Answer

Supplement those of the Common Rule and FDA.

Question 37

How are the ethical standards for student uses and disclosures of patients' health information different from those for regular members of the healthcare workforce?

Accepted Answer

Some would say it is higher, because patients do not always benefit from students' access to their data.

Question 38

For health information privacy and security, are the legal and regulatory requirements for students different from those for regular members of the healthcare workforce?

Accepted Answer

No, students must meet the same standards as a regular member of the workforce performing the same tasks.

Question 39

Use of social media tools and other new technologies to facilitate training-related communications is:

Accepted Answer

Depends on the organization's policies, so you should check with your organization's officials about what is allowed or prohibited.

Question 40

In regard to reporting privacy or security problems, are the requirements for students the same as for regular workers?

Accepted Answer

Yes. Like any other member of the workforce, students are obligated to report problems they are not in a position to correct.

Question 41

Patients have to provide an additional, specific authorization for training uses and disclosures of their information.

Accepted Answer

False

Question 42

Which of the following is a good practice if one wishes to avoid social engineering attacks?

Accepted Answer

All of the above

Question 43

Which of these is not a good practice for controlling computer access?

Accepted Answer

Logging into systems with a shared user-ID or password

Question 44

Which of these is not a good practice for protecting computing devices?

Accepted Answer

Login and screen-saver passwords, or token or biometric mechanisms, are disabled to make it easier to use the device quickly.

Question 45

Which of the following are important for protecting computing devices and systems?

Accepted Answer

All of the above

Question 46

Which of these is not a good security practice for web browsing?

Accepted Answer

Browsing to sites using links sent in emails without taking steps to assure the destination is safe.

Question 47

Desktop computers are often provided in the workplace by organizations, and laptops may be as well. However, portable devices (such as tablets and smartphones) may more commonly be allowed on a BYOD basis. For a BYOD (personally-owned) device:

Accepted Answer

Organizations may have requirements about how BYOD devices may be configured or used, as a condition of accessing the organization's information resources.

Question 48

Secure disposal of a desktop or laptop computer at the end of its service life is:

Accepted Answer

Generally considered essential for all computing and storage devices. One should not assume there is no sensitive personal or organizational data on a device or accessible by it.

Question 49

Supplemental security software (such as anti-virus [anti-malware]) is:

Accepted Answer

Increasingly common for smartphones and tablets, and can include protections like remote-locate, remote-disable, and remote-data-wipe.

Question 50

Secure communications, like those provided by encrypted web connections using https or a virtual private network (VPN), are:

Accepted Answer

Generally considered essential.

Question 51

When choosing the security measures needed for a desktop or laptop computer:

Accepted Answer

The more security measures applied, the more secure a computer will be. However, it is impossible to have a uniform set of rules for all circumstances.

Question 52

Ensuring data backups for data stored on a portable device is generally considered:

Accepted Answer

Necessary when the device would otherwise be the only source of hard-to-replace data, but the backup mechanism must also be secure

Question 53

External labeling with a physical label, or configuring a device to display the owner's name and contact information on a login screen, is:

Accepted Answer

Generally considered a good idea, because it allows the device to be returned to its owner when found. However, always check organizational policies about the practice.

Question 54

Enabling a device login password or PIN, and an inactivity timeout to force (re)login with that password or PIN after the device is idle for a defined period, is generally considered:

Accepted Answer

Generally considered essential for any portable device.

Question 55

Compared to fixed location (desktop) computers, physical security for portable devices is:

Accepted Answer

Generally more necessary, because portable devices tend to be used in physical environments that are inherently less secure.

Question 56

Desktop computers are often provided in the workplace by organizations, and laptops may be as well. However, portable devices (such as tablets and smartphones) may more commonly be allowed on a BYOD basis. For a BYOD (personally-owned) device:

Accepted Answer

Organizations may have requirements about how BYOD devices may be configured or used, as a condition of accessing the organization's information resources.

Question 57

Which of these is a greater risk off site than when a computer is used in a protected office environment?

Accepted Answer

All the above

Question 58

What administrative measures do you usually need to take?

Accepted Answer

All the above

Question 59

What technical measures do you usually need to take with an off-site computer?

Accepted Answer

All the above

Question 60

What physical security measures do you usually need to take for an off-site computer?

Accepted Answer

All the above

Question 61

Under HIPAA, an organization is required to do which of the following?

Accepted Answer

Appoint a Privacy Officer to administer HIPAA rules.

Question 62

Recruiting into research ...

Accepted Answer

Can qualify as an activity preparatory to research, at least for the initial contact, but data should not leave the covered entity.

Question 63

Fines and jail time (occasionally) for information security failures are:

Accepted Answer

Generally, only applied for serious, deliberate misuse, where someone intentionally accesses data in order to do harm or for personal gain.

Question 64

Which of these is not a good security practice for portable devices?

Accepted Answer

Disabling any remote-locate, remote-shutdown, and remote-erase capabilities because these can accidentally erase data.

CITI - HIPAA Training

Unlock all answers in this set

Haven't found what you need?