HIPAA

State or local laws can never override HIPAA.

Protected health information (PHI) requires an association between an individual and a diagnosis.

Some covered entities are exempted under HIPAA from submitting claims electronically using the standard transaction format.

The acronym EDI stands for

Which group of providers would be considered covered entities?

Which law takes precedence when there is a difference in laws?

A health care clearinghouse functions as

The HIPAA Officer is responsible to train which group of workers in a facility? a. Nursing staff, radiology department staff, laboratory staff, and medical staff b. Housekeeping staff and maintenance staff c. Office workers (medical records and business office/patient accounts staff) d. a and c e. a, b, and c

What are the main areas of health care that HIPAA addresses? Select the best answer.

Medical Savings Account (now Health Savings Account) is a means to shelter funds from taxes to pay for....

Written policies are a responsibility of the HIPAA Officer.

What type of health information does the Security Rule address?

Only clinical staff need to understand HIPAA.

The HIPAA Privacy Officer is responsible for....

Choose the correct acronym for Public Law 104-91.

Home help personnel, taxicab companies, and carpenters may fit the definition of a covered entity.

COBRA (Consolidated Omnibus Budget Reconciliation Act of 1985) helps workers who have coverage with a....

How many titles are included in the Public Law 104-91?

What government agency approves final rules released in the Federal Register?

Which is not a responsibility of the HIPAA Officer?

An employer who has fewer than 50 employees and is self-insured is a covered entity.

The HIPAA Security Officer is responsible for

Privacy Rule covers disclosure of protected health information (PHI) in any form or media.

The Department of Health and Human Services (DHHS) is responsible to notify all health care providers of changes in the HIPAA rulings.

Which group is not one of the three covered entities?

Under HIPAA, providers may choose to submit claims either on paper or electronically.

Health care professionals have generally found that HIPAA has simplified claims submissions.

With the passage of HIPAA, large health care providers would be treated with faster service since their volume of claims is larger than small rural providers.

What year did Public Law 104-91 pass both houses of Congress?

List the four key words that summarize the areas of health care that HIPAA has addressed.

Which group is the focus of Title I of HIPAA ruling?

PHI (protected health information) is

Which is the most efficient means to store PHI?

There is a 24-month grace period after the effective date for the HIPAA rules before a covered entity must comply with the ruling.

What is a major point of the Title I portion of HIPAA?

Under HIPAA, all covered entities will be treated equally regarding payment for health care services.

What does HIPAA define as a "covered entity"? a. Health care clearinghouse b. Health plan c. Patient d. Provider e. a, b, and d f. c and d

What is the intent of the clarification Congress passed in 1996?

Since 1996 when HIPAA was written, why are more laws passed relating to HIPAA regulations?

According to HIPAA, written consent is required for treatment of a patient.

Medical identity theft is a growing concern today for health care providers.

If a patient does not sign the receipt of a Notice of Privacy Practices (NOPP), the physician can refuse to treat the patient under HIPAA law.

Which governmental agency wrote the details of the Privacy Rule?

The HIPAA definition for marketing is when

The minimum necessary policy encouraged by HIPAA allows disclosure of

Regarding the listed disclosures of their PHI, individuals may see

If an individual feels that a covered entity has violated the HIPAA Privacy Rule, a complaint is to be filed with the

HIPAA training is

Insurance companies who provide automobile and life insurance come under the HIPAA ruling as covered entities.

If a medical office does not use electronic means to send its insurance claims, it is considered a covered entity.

The HIPAA Privacy Rule gives patients assurance that their personal health information will be treated the same no matter which state or organization receives their medical information.

During an investigation by the Office for Civil Rights, the inspector will depend upon the HIPAA Officer to know the details of the written policies of the organization.

The Regional Offices of the Centers for Medicare and Medicaid Services (CMS) is the only way to contact the government about HIPAA questions and complaints.

The response, "She was taken to ICU because her diabetes became acute" is an example of HIPAA-compliant disclosure of information.

Financial records fall outside the scope of HIPAA.

Nursing notes are not considered PHI since they are not physician's notes and therefore are not protected by HIPAA.

It is possible for a first name and zip code to be considered individually identifiable health information (IIHI).

A covered entity does not have to disclose PHI to the Office for Civil Rights if they come to investigate a complaint. That is not allowed by HIPAA law.

In HIPAA usage, TPO stands for treatment, payment, and optional care.

A signed receipt of the facility's Notice of Privacy Practices (NOPP) is mandated by the Privacy Rule in order for a patient to receive services from a health care provider.

Who in the health care organization is responsible to know where the written policies are located regarding HIPAA compliance?

What specific government agency receives complaints about the HIPAA Privacy ruling?

The Privacy Rule a. applies only to protected health information (PHI). b. establishes policies for covered entities. c. details when authorization to release PHI is needed. d. none of the above. e. both answers A and C.

Protected health information is an association between a(n)

Consent as defined by HIPAA is for..... a. permission to reveal PHI for payment of services provided to a patient. b. permission to reveal PHI for comprehensive treatment of a patient. c. permission to reveal PHI for normal business operations of the provider's facility. d. all of the above. e. both A and B

Use and disclosure of PHI is permitted without authorization with the EXCEPTION of which of the following?

An emancipated minor is

Research organizations are permitted to receive

Psychotherapy notes or process notes include

A hospital or other inpatient facility may include patients in their published directory

Typical Business Associate individuals are

Requesting to amend a medical record was a feature included in HIPAA because of

During an investigation by the Office for Civil Rights, each provider is expected to have the following EXCEPT

The Office for Civil Rights receives complaints regarding the Privacy Rule. About what percentage of these complaints have been ruled either no violation or the entity is working toward compliance?

For individuals requesting to amend their medical record

Written policies and procedures relating to the HIPAA Privacy Rule

According to AHIMA report, the most common problem that health care providers face in relation to PHI is....

The minimum penalty per incidence for violations that the Office for Civil Rights finds for noncompliance to the Privacy Rule is...

When there is an alleged violation to HIPAA Privacy Rule....

Another name for the Title II portion of HIPAA law is....

When policies for a facility are in both ------and ------form, the Office for Civil Rights will assume the policies are the most trustworthy.

Many pieces of information can connect a patient with his diagnosis. Which pair does not show a connection between patient and diagnosis?

Authorization is not needed to disclose protected health information (PHI) in which of the following circumstances?

Any Business Associate who finds a breach of protected health information (PHI) must report it to....

A HIPAA investigator seeks to find willingness in each organization to comply with what is------- for their particular situation.

A refusal by a patient to sign a receipt of the NOPP allows the physician to refuse treatment to that patient.

All covered entities must keep e-PHI secure to ensure data integrity, yet keep it available for access by those who treat patients.

Compliance with the Security Rule is the sole responsibility of the Security Officer.

Risk management, as written under Administrative Safeguards, is a continuous process to re-evaluate electronic hardware and software for possible weaknesses in security.

A workstation login and password should be set to allow access to information needed for the particular location of the workstation, rather than the job description of the user.

Protecting e-PHI against anticipated threats or hazards

Integrity of e-PHI requires confirmation that the data

The HIPAA Security Officer is to see that each job description is evaluated to...

What are the three areas of safeguards the Security Rule addresses?

If there has been a breach in the security of medical information systems, what are the steps a covered entity must take?

Security and privacy of protected health information really cover the same issues.

The Security Rule requires that all paper files of medical records be copied and kept securely locked up.

Compliance to the Security Rule is solely the responsibility of the Security Officer.

Requirements that are identified as "addressable" under the Security Rule may be omitted by the Security Officer.

The Centers for Medicare and Medicaid Services (CMS) have information on their Web site to help a HIPAA Security Officer know the required and addressable areas of securing e-PHI.

Risk management for the HIPAA Security Officer is a "one-time" task.

Only a serious security incident is to be documented and measures taken to limit further disclosure.

If a business visitor is also a Business Associate, that individual does not need to be escorted in the building to ensure protection of PHI.

"At home" workers such as transcriptionists are not required to follow the workstation security rules for passwords, viewing of monitors by others, or locking of computer screens.

One good requirement to ensure secure access control is to install automatic logoff at each workstation.

To protect e-PHI that is sent through the Internet, a covered entity must use encryption technology to minimize the risks. E-PHI that is "at rest" must also be encrypted to maintain security.

Only monetary fines may be levied for violation under the HIPAA Security Rule.

The Office of HIPAA Standards seeks voluntary compliance to the Security Rule.

The Office of HIPAA Standards may not initiate an investigation without receiving a formal complaint.

Closed circuit cameras are mandated by HIPAA Security Rule.

Security of e-PHI has to do with keeping the data secure from a breach in the information system's security protocols.

Access privilege to protected health information is

Keeping e-PHI secure includes which of the following?

Which are the five areas the DHHS has mandated each covered entity to address so that e-PHI is maintained securely?

HIPAA Security Rule applies to data contained in...

The required areas of the Security Rule

The Administrative Safeguards mandated by HIPAA include which of the following?

Risk analysis in the Security Rule considers

Responsibilities of the HIPAA Security Officer include

Information access is a required administrative safeguard under HIPAA Security Rule. It is defined as

Record of HIPAA training is to be maintained by a health care provider for

What step is part of reporting of security incidents?

The ability to continue after a disaster of some kind is a requirement of Security Rule. What item is considered part of the contingency plan or business continuity plan?

Business Associate contracts must include

Reasonable physical safeguards for patient care areas include....

The Security Officer is to keep record of.....

Which of the following items is a technical safeguard of the Security Rule?

Audit trails of computer systems include

Integrity of e-PHI requires confirmation that the data

The act of changing readable text into a vast series of "garbled" characters using complex mathematical algorithms is called...

The Security Officer is responsible to review all...

Telemedicine videoconference tapes are

Use of e-mail for transmitting PHI is...

Complaints about security breaches may be reported to...

Investigation of complaints of violations to the Security Rule are under the direction of the...

The policy of disclosing the "minimum necessary" e-PHI addresses....

HIPAA training must be provided to....

Whenever a device has become obsolete, the Security Office must....

The HIPAA Security Officer has many responsibilities. Which of the following is not a job of the Security Officer?

All health care staff members are responsible to..... a. Protect access to the electronic devices assigned to them. b. See that patients are given the Notice of Privacy Practices for their specific facility. c. Be aware of HIPAA policies and where to find them for reference. d. Report any incident or possible breach of protected health information (PHI). e. All of the above.

The Security Rule addresses four areas in order to provide sufficient physical safeguards. Which of the following is NOT one of them?

To ensure minimum opportunity to access data, passwords......

The documentation for policies and procedures of the Security Rule must be kept for....

A health care provider who is compliant with the Privacy and Security Rules of HIPAA has greatly improved protection against medical identity theft.

All four type of entities written in the original law have been issued unique identifiers.

The main reason for unique identifiers is so....

Which federal government office is responsible to investigate HIPAA privacy complaints?

Protected health information (PHI) includes....

What are the three types of covered entities that must comply with HIPAA?

Under HIPAA, members of the press can....

The new National Provider Identifier (NPI) has "intelligence" that allows you to find out the provider's specialty.

Faxing PHI is still permitted under HIPAA law.

Administrative Simplification focuses on reducing the time it takes to submit health claims. The unique identifiers are part of this simplification.

The unique identifier for employers is the Social Security Number (SSN) of the business owner.

The National Provider Identifier (NPI) issued by Centers for Medicare and Medicaid Services (CMS) replaces only those numbers issued by private health plans.

One reason not to use the SSN for patient identifiers is that there is no check digit for verification of the number.

Covered entities who violate HIPAA law are only punished with civil, monetary penalties.

If a covered entity has disclosed some protected health information (PHI) in violation of HIPAA, a patient can sue the covered entity for damages.

HIPAA seeks to protect individual PHI and discloses that information only when it is in the best interest of the patient.

When registering a patient for outpatient or inpatient services, the office does not need to enter complete information prior to the encounter. It can be found out later.

Prescriptions may only be picked up by the patient to protect the privacy of the individual's health information.

Notice of Privacy Practices (NOPP) must be given to patients every time they visit the facility.

When a patient refuses to sign a receipt of the NOPP, the facility will ask the patient to leave since they cannot treat the patient without a signature.

HIPAA allows disclosure of PHI in many new ways.

When a patient is transferred to another facility, access to the medical records by the receiving facility is no longer permitted under HIPAA.

All four parties on a health claim now have unique identifiers.

The law Congress passed in 1996 mandated identifiers for which four categories of entities?

HIPAA requires that using unique identifiers

Including employers in the standard transaction

The adopted standard identifier for employers is the

Use of the EIN on a standard transaction is required

Enforcement of the unique identifiers is under the direction of

Health plan identifiers defined for HIPAA are....

Two of the reasons for patient identifiers are

Congress passed HIPAA to focus on four main areas of our health care system. They are to

Administrative Simplification means that all

Which government department did Congress direct to write the HIPAA rules?

Questions other people have asked about HIPAA can be found by searching FAQ at...

The source documents for original federal documents such as the Federal Register can be found at

Fraud and abuse investigation of HIPAA Privacy Rule is under the direction of

Which federal government office is responsible to investigate non-privacy complaints about HIPAA law?

Funding to pay for oversight and compliance to HIPAA is provided by...

American Health Information Management Association (AHIMA) has found that the problems of complying with HIPAA Privacy Rule are mainly those that

Medical identity theft is...

In keeping with the "minimum necessary" policy, an office may leave....

Privacy of PHI includes

Standardization of claims allows covered entities to... a. communicate efficiently and quickly, which saves time and money. b. save the cost of new computer systems. c. simplify the billing process since all claims fit the same format. d. all of the above. e. both A and C.

Filing a complaint with the government about a violation of HIPAA is possible...

What are the three covered entities that must comply with HIPAA?

HIPAA serves as a national standard of protection.

Coded identifiers for all parties included in a claims transaction are needed to

The Employer Identification Number (EIN) contains...

When patients "opt-out" of the facility directory, it means...

When visiting a hospital, clergy members are

The HITECH (Health information Technology for Economic and Clinical Health) mandates all health care providers adopt high standards of technology without any compensation for the cost to individual providers

One process mandated to health care providers is writing prescriptions via e-prescribing.

One additional benefit of completely electronic medical records is that more accurate data can be obtained from a greater population, so efficient research can be done to improve our country's health status.

With the ruling in the Omnibus Rule of 2013, any genetic information is now covered by HIPAA Privacy and Security Rule.

The purpose of health information exchanges (HIE) is so

Health care providers set up patient portals to

The long range goal of HIPAA and further refinements of the original law is... a. So all patients can maintain their own personal health record (PHR). b. To develop interoperability so all medical information is electronic. c. To develop health information exchanges (HIE) for providers to view the medical records of other providers for better coordination of care. d. To have the electronic medical record (EMR) used in a meaningful way. e. All of the above

One benefit of personal health records (PHR) is that...

How can you easily find the latest information about HIPAA?

The Personal Health Record (PHR) is the legal medical record.

HIPAA in 1996 enacted security measures that do not need updating and are valid today as written.

After a patient downloads personal health information, all the Security and Privacy measures of HIPAA are gone.

Any changes or additions made by patients in their Personal Health record are automatically updated in the Electronic Medical Record (EMR).

When there is a difference in state law and HIPAA, HIPAA will always supersede the local or state law.

What information is not to be stored in a Personal Health Record (PHR)?

What is the difference between Personal Health Record (PHR) and Electronic Medical Record (EMR)?

The Meaningful Use mandate is part of

The Health Information Technology for Economic and Clinical Health (HITECH) is part of...

Who is responsible to update and maintain Personal Health Records?

Which safeguard is not required for patients to access their Patient Portal...

What is the name of the format that allows other providers to access another physician's record of a patient?

Which federal act mandated that physicians use the Health Information Exchange (HIE)?

The Medicare Electronic Health Record Incentive Program is part of Affordable Care Act (ACA) and is under the direction of

Physicians were given incentives to use "e-prescribing" under which federal mandate?

Meaningful Use program included incentives for physicians to begin using all but which of the following?

Strengthened restrictions on security redefineed the subcontractors of business associates who might have even incidental exposure to Personal Health Information (PHI) as...

The implementation of unique Health Plan Identifiers (HPID) was mandated in which ruling?

The Centers for Medicare and Medicaid Services (CMS) set up the ICD-9-CM Coordination and maintenance Committee to

Health Information Exchanges (HIE) are designed to allow authorized physicians to exchange health information. Which federal law(s) influenced the implementation and provided incentives for HIE? a. American Recovery and Reinvestment Act (ARRA) of 2009 b. Affordable Care Act (ACA) of 2009 c. Omnibus Rule of 2013 d. All of these

Enforcement of Health Insurance Portability and Accountability Act (HIPAA) is under the direction of....

Where is the best place to find the latest changes to HIPAA law?

If any staff member is found to have violated HIPAA rules, what is a possible result?

Which organization directs the Medicare Electronic Health Record Incentive Program?

Electronic messaging is one important means for patients to confer with their physicians. What platform is used for this?

A result of this federal mandate brought increased transparency and better efficiency, and empowered patients to utilize the electronic health record of their physician to view their own medical records. This mandate is called

Genetic Information is now protected as all other Personal Health Information (PHI) with the passing of which federal law?

Which federal office has the responsibility to enforce updated HIPAA mandates?

Reliable accuracy of a personal health record is limited

To comply with HIPAA, it is vital to... a. Maintain integrity and security of protected health information (PHI). b. Ensure that protected health information (PHI) is kept private. c. Use proper codes to secure payment of medical claims.

Genetic information is

Patients are given access to their physician's EMR to view their own records through a (an)...

The purpose of Health Information Exchange (HIE) is to facilitate secure encrypted transport of health information between...