A home health aide keeps a personal notebook listing patient names and the wound-care instructions given at each visit. Under HIPAA, is this notebook subject to PHI protections?
A. Yes, because it is individually identifiable health information maintained by a covered entity's workforce member in connection with providing care
B. No, because handwritten notes are never covered by HIPAA
C. No, because the notebook is the aide's personal property
D. Yes, but only once the notebook is typed into the agency's official chart
Show answer and reasoning
Correct answer: A. Yes, because it is individually identifiable health information maintained by a covered entity's workforce member in connection with providing care
Correct. 45 CFR § 160.103 defines PHI broadly as individually identifiable health information held or transmitted in any form, including paper, by a covered entity; a workforce member's care notes about a specific patient qualify regardless of format.
- B: Wrong. The PHI definition is format-neutral; paper and handwritten records are covered exactly as electronic ones are.
- C: Wrong. Ownership of the physical notebook does not remove the information from HIPAA's reach, since the aide created it while performing a job function for a covered entity.
- D: Wrong. The information is PHI from the moment it is recorded about an identifiable patient in connection with care, not only after it is transcribed into the official record.
Source: 45 CFR § 160.103
A self-insured employer administers its own group health plan and reviews employee medical claims to decide payment. In that capacity, how is the employer's group health plan treated under HIPAA?
A. As a business associate of its employees
B. As exempt from HIPAA because it is an employer-sponsored plan
C. As a covered entity, because a group health plan is a type of health plan under the definition
D. As a workforce member of the third-party administrator
Show answer and reasoning
Correct answer: B. As exempt from HIPAA because it is an employer-sponsored plan
Wrong. Employer-sponsored group health plans are not exempt; they fall within the health plan category and must comply with HIPAA, often through a plan document and firewall separating plan administration from other employer functions.
- A: Wrong. The plan is not performing a function on behalf of a separate covered entity here; it is itself the health plan holding the claims data.
- C: This is the correct answer, listed second: a group health plan meets 45 CFR § 160.103's definition of a covered entity because it pays for or provides the cost of medical care to plan participants.
- D: Wrong. A workforce member is an individual under the direct control of a covered entity, not an entire benefit plan.
Source: 45 CFR § 160.103
A cloud storage vendor hosts encrypted backups of a clinic's electronic health record system but has no employees who ever view the actual patient data. Is the vendor a business associate under HIPAA?
A. No, because it never actually reads the PHI it stores
B. No, because encryption removes the data from HIPAA's scope entirely
C. Yes, but only if the vendor is physically located in the same state as the clinic
D. Yes, because it maintains PHI on behalf of a covered entity, and access to view the data is not required to meet the definition
Show answer and reasoning
Correct answer: D. Yes, because it maintains PHI on behalf of a covered entity, and access to view the data is not required to meet the definition
Correct. Maintaining PHI on behalf of a covered entity, such as hosting encrypted EHR backups, meets the business associate definition regardless of whether the vendor's staff ever views the underlying data.
- A: Wrong. The business associate definition in 45 CFR § 160.103 covers entities that create, receive, maintain, or transmit PHI on behalf of a covered entity; actually viewing the content is not a required element.
- B: Wrong. Encryption is a safeguard, not an exemption; encrypted PHI is still PHI, and the vendor storing it is still a business associate.
- C: Wrong. Business associate status does not depend on the vendor's physical location relative to the covered entity.
Source: 45 CFR § 160.103
An unpaid nursing student completes a clinical rotation at a hospital and has access to the EHR under the hospital's direct supervision. Under HIPAA, is the student part of the hospital's workforce?
A. No, because workforce status requires a paid employment relationship
B. No, because students are governed only by their school's policies, not the hospital's
C. Yes, because workforce includes employees, volunteers, trainees, and others under the direct control of the covered entity, whether or not they are paid
D. Yes, but only after the student signs a separate business associate agreement
Show answer and reasoning
Correct answer: C. Yes, because workforce includes employees, volunteers, trainees, and others under the direct control of the covered entity, whether or not they are paid
Correct. Workforce is defined to include employees, volunteers, trainees, and other persons under the direct control of a covered entity, regardless of whether they are paid, which covers a supervised student on rotation.
- A: Wrong. 45 CFR § 160.103's workforce definition does not require pay; volunteers and trainees are explicitly included.
- B: Wrong. While the student's school may have its own rules, the student is also subject to the hospital's HIPAA policies while performing a supervised clinical rotation there.
- D: Wrong. A business associate agreement applies to a separate legal entity performing functions on behalf of a covered entity; a supervised trainee under the hospital's direct control is workforce, not a business associate.
Source: 45 CFR § 160.103
A hospital scheduler needs to confirm which physician a patient is seeing tomorrow in order to book a follow-up test. What does the minimum necessary standard require of the scheduler?
A. Accessing only the appointment and provider information needed to complete the scheduling task
B. Reviewing the patient's full chart, including unrelated specialty visits, to be thorough
C. Contacting the patient directly to ask them to read out their own chart
D. Copying the entire record into a scheduling spreadsheet for future reference
Show answer and reasoning
Correct answer: A. Accessing only the appointment and provider information needed to complete the scheduling task
Correct. 45 CFR § 164.502(b) requires limiting use of PHI to the amount reasonably necessary for the specific task, which here is only the scheduling and provider information needed to book the test.
- B: Wrong. Reviewing the entire chart, including unrelated visits, exceeds what is needed to schedule one follow-up test.
- C: Wrong. This does not address the minimum necessary standard, and shifting the burden to the patient is not a substitute for the workforce member limiting their own access.
- D: Wrong. Duplicating the full record into a separate spreadsheet for a task that only needs scheduling data goes well beyond minimum necessary and creates an unsecured copy of PHI.
Source: 45 CFR § 164.502(b)
