Free Arizona HIPAA Practice Test Online

Correct answer: C. Disclosure authorized by the patient in writing

Incorrect: Patient authorization is a standard permitted disclosure ground under A.R.S. 36-509.

• A: Correct: Under A.R.S. 36-509, disclosure to media for promotional purposes about the facility is not a permitted disclosure; information must be directly relevant to the recipient's involvement.
• B: Incorrect: Disclosure to treating physicians is a permitted disclosure under Arizona law for providing healthcare services.
• D: Incorrect: Disclosure to quality review organizations with confidentiality agreements is specifically permitted under A.R.S. 36-509.

Correct answer: C. To exposed healthcare workers or first responders who have documented occupational exposure

Correct: Under A.R.S. 36-664, disclosure to healthcare workers or first responders with documented occupational exposure is a permitted disclosure.

• A: Incorrect: Public social media disclosure of communicable disease information violates Arizona's confidentiality requirements.
• B: Incorrect: Employer disclosure requires specific authorization or legal mandate; it is not a blanket permitted disclosure.
• D: Incorrect: Arizona law requires specific authorization for disclosures to family members; providers cannot unilaterally choose to disclose.

Correct answer: D. Only dental records directly related to injuries from the accident, not the patient's complete dental history

Correct: The minimum necessary principle under 45 CFR 164.502(b) requires disclosure of only the specific records needed for the insurance investigation, not the patient's entire history.

• A: Incorrect: Disclosing five years of complete history exceeds the minimum necessary for the specific accident claim investigation.
• B: Incorrect: All historical procedures are not necessary to answer the insurance company's specific inquiry about accident-related injuries.
• C: Incorrect: General information without specific details would not fulfill the insurance company's legitimate need for records related to the accident claim.

Correct answer: C. Healthcare operations activity related to quality improvement

Correct: Under 45 CFR 164.501, quality evaluation and improvement activities are part of 'health care operations,' a permitted use under the Privacy Rule.

• A: Incorrect: Payment processing concerns billing and reimbursement, not quality outcome analysis.
• B: Incorrect: Quality operations activities do not require individual patient informed consent; they are a permitted use under the Privacy Rule.
• D: Incorrect: Treatment coordination refers to direct patient care activities with other providers, not quality review of existing treatment.

Correct answer: D. The right to request an amendment to the medical record with the healthcare provider

Correct: Under 45 CFR 164.526, individuals have the right to request that a covered entity amend protected health information if they believe it is inaccurate or incomplete.

• A: Incorrect: Covered entities do not automatically delete information; they process amendment requests and document whether the amendment is accepted or denied.
• B: Incorrect: HIPAA grants patients the explicit right to request amendments to their records.
• C: Incorrect: While a patient may pursue legal action, the HIPAA right of amendment is the specific regulatory mechanism for addressing inaccuracies.