Select the correct statement regarding the requirements of HIPAA regulations.

1. A. A covered entity must have and apply sanction against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity)
2. B. A covered entity does not need to train all members of its workforce whose functions areaffected by a change in policy or procedure.
3. C. A covered entity must designate, and document, a privacy officer, and a HIPAA compliance officer
4. D. A covered entity may require individuals to waive their rights.
5. E. A covered entity must require the individual to sign the Notice of Privacy Practices prior to delivering any treatment related service.

Correct Answer: A

Select the correct statement regarding the administrative requirements of the HIPAA privacy rule.

1. A. A covered entity must apply disciplinary sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity.
2. B. A covered entity need not train all members of its workforce whose functions are materially affected by a change in policy or procedure.
3. C. A covered entity must designate, and document, a contact person responsible for receiving acknowledgements of Notice of Privacy Practice.
4. D. A covered entity may require individuals to waive their rights.
5. E. A covered entity must provide maximum safeguards for PHI from any intentional or unintentional use or disclosure that is in violation of the regulations and to limit incidental uses and disclosures made pursuant to permitted or required use or disclosure.

Correct Answer: A

Assigning a name and/or number for identifying and tracking users is required by which security rule implementation specification?

1. A. Access Authentication
2. B. Integrity Controls
3. C. Authorization and/or Supervision
4. D. Data Authentication
5. E. Unique User Identification

Correct Answer: E

A doctor is sending a patient's lab work to a lab that is an external business partner. The lab and the doctor's staff are all trained on the doctor's Privacy Practices. The doctor has a signed Notice from the patient. In order to use or disclose PHI, the lab MUST:

1. A. Request that the patient sign the lab's Notice of Privacy Practices.
2. B. Do nothing more - the activity is covered by the doctor's Notice of Privacy Practices.
3. C. Obtain a specific authorization from the patient
4. D. Obtain a specific authorization from the doctor.
5. E. Verify that the doctor's Notice of Privacy Practices has not expired.

Correct Answer: B

A business associate:

1. A. Requires PKJ for the provider and the patient.
2. B. Is electronically stored information about an individual's lifetime health status and healthcare.
3. C. Is another name for an HMO.
4. D. Identities all non-profit organizations.
5. E. Is a person or an entity that on behalf of the covered entity performs or assists in the performance of a function or activity invoking the use or disclosure of health- relatedinformation.

Correct Answer: E