Free Connecticut HIPAA Practice Test Online

Correct answer: A. The information is individually identifiable health information created or received by a covered entity

45 CFR § 160.103 defines PHI as individually identifiable health information held or transmitted by a covered entity or business associate in any form; the identity plus health status is what triggers PHI status, not the location of the conversation.

• B: Location alone does not create PHI status — the same conversation held off-site would still be PHI if it is individually identifiable health information from a covered entity; conversely, generic facility information spoken in a hallway is not PHI.
• C: PHI status does not depend on which type of workforce member is speaking; any workforce member handling identifiable health information is bound by the Privacy Rule.
• D: Claims payment status is irrelevant to whether information meets the definition of PHI; PHI is about the health information and identifiers themselves.

Correct answer: B. Only the scheduling information needed to confirm the appointment, such as date, time, and provider

45 CFR § 164.502(b) requires covered entities to limit PHI access to what is reasonably necessary to accomplish the intended purpose; confirming a scheduled appointment only requires scheduling-related data.

• A: Pulling the full chart, including unrelated specialist notes, goes well beyond what is needed to confirm an appointment and violates the minimum necessary standard.
• C: Billing and insurance history is unrelated to the task of confirming an appointment time and exceeds the minimum necessary scope.
• D: Technical ability to open a record is not the standard; access must be limited by job function and task, per § 164.502(b) and role-based access requirements under § 164.308(a)(4).

Correct answer: C. A disclosure made pursuant to and consistent with a valid patient authorization

45 CFR § 164.502(b)(2) lists disclosures made pursuant to a valid authorization under § 164.508 among the enumerated exceptions to the minimum necessary standard, because the individual has specifically authorized the scope of that disclosure.

• A: A generic internal business review pull is not one of the listed exceptions and must still be limited to what is reasonably necessary for that purpose.
• B: Forwarding PHI to a personal email account is not a minimum necessary exception; it is an unauthorized use that also raises safeguard and security concerns under § 164.530(c) and the Security Rule.
• D: Pulling broad data 'just in case' is the opposite of minimum necessary and is not an enumerated exception under § 164.502(b)(2).

Correct answer: D. No, because sharing PHI for treatment purposes is permitted without authorization under the TPO provisions

45 CFR § 164.506 permits covered entities to use and disclose PHI for treatment purposes, including referrals and care coordination between providers, without a separate patient authorization.

• A: This overstates the authorization requirement — disclosures for treatment among providers involved in a patient's care are a recognized TPO exception and do not require written authorization.
• B: There is no requirement that the treating provider and referral specialist share a physical location; the treatment exception applies regardless of location.
• C: The minor status of the patient does not change the TPO exception for treatment-related disclosures between providers.

Correct answer: A. No, this is a permissible incidental disclosure because reasonable safeguards were otherwise in place

45 CFR § 164.502(a)(1)(iii) permits incidental uses and disclosures that occur as a by-product of an otherwise permitted use or disclosure, provided the covered entity has applied reasonable safeguards and the minimum necessary standard where applicable — calling a name in a waiting room is a classic example.

• B: The Privacy Rule does not impose an absolute ban on speaking names; it requires reasonable safeguards to minimize incidental exposure, not perfect silence.
• C: An incidental disclosure that occurs despite reasonable safeguards is not a reportable breach; breach notification applies to impermissible acquisition, access, use, or disclosure that compromises the security or privacy of PHI.
• D: A patient's name combined with the fact of receiving care at that facility is itself PHI under § 160.103; it is not true that only diagnosis-level detail is protected.