Free Colorado HIPAA Practice Test Online

Correct answer: A. A health plan that pays claims for its enrollees

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction.

• B: Wrong. A shredding vendor performs a service involving PHI on behalf of a covered entity, which makes it a business associate, not a covered entity itself.
• C: Wrong. A cloud host that stores PHI for a covered entity is a business associate under 45 CFR 160.103, since it creates, receives, maintains, or transmits PHI on the covered entity's behalf.
• D: Wrong. A billing service acting for a provider is a business associate; it does not itself meet the definition of health plan, clearinghouse, or provider.

Correct answer: B. Business associate, because it creates, receives, maintains, or transmits PHI on the hospital's behalf

Correct. Under 45 CFR 160.103, a person or entity that creates, receives, maintains, or transmits PHI to perform a function on behalf of a covered entity is a business associate, and must operate under a business associate agreement.

• A: Wrong. The vendor does not provide treatment, payment, or plan administration itself; it supports the hospital's operations, which is the hallmark of a business associate, not a covered entity.
• C: Wrong. Access to and handling of PHI on a covered entity's behalf brings the vendor squarely within the business associate definition, so it is subject to HIPAA obligations.
• D: Wrong. Hybrid entity status applies to a single legal entity that designates some of its own internal components as covered functions, not to a separate outside vendor.

Correct answer: B. A signed business associate agreement meeting the requirements of 45 CFR 164.504(e)

Correct. 45 CFR 164.504(e) requires a written business associate agreement that establishes the permitted uses of PHI, safeguard obligations, and breach reporting duties before a business associate may access PHI.

• A: Wrong. HIPAA requires a written contract, not just a verbal understanding, before PHI can be shared with a business associate.
• C: Wrong. Individual patient consent is not the mechanism that authorizes routine billing disclosures to a business associate; the BAA governs that relationship.
• D: Wrong. An informal promise does not satisfy the Privacy Rule's requirement for a documented, legally binding business associate agreement.

Correct answer: B. Only the scheduling information needed to confirm the appointment

Correct. 45 CFR 164.502(b) requires covered entities to make reasonable efforts to limit PHI access to the minimum necessary to accomplish the intended purpose, which here is confirming an appointment.

• A: Wrong. Pulling the full chart, especially psychotherapy notes, far exceeds what is needed for a scheduling task and violates 45 CFR 164.502(b).
• C: Wrong. Billing and insurance history is unrelated to confirming a scheduled appointment and is not minimally necessary for that task.
• D: Wrong. Accessing unrelated family members' records is unnecessary for the stated purpose and is not permitted under the minimum necessary standard.

Correct answer: A. A disclosure to another treating physician for treatment purposes

Correct. 45 CFR 164.502(b)(2) exempts disclosures to health care providers for treatment purposes from the minimum necessary standard, since treating clinicians need full clinical context.

• B: Wrong. Marketing communications are not treatment, payment, or health care operations disclosures made to the individual, so the minimum necessary standard still applies and marketing generally requires authorization.
• C: Wrong. Internal compliance reviews are still subject to the minimum necessary standard; access should be limited to what the audit actually requires.
• D: Wrong. Research access to PHI is not automatically exempt; it generally requires a minimum necessary determination, IRB/Privacy Board waiver, authorization, or a data use agreement for a limited data set.