Which of the following best defines 'protected health information' (PHI) under HIPAA?
A. Any information a hospital keeps about its employees, including payroll records
B. Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium
C. Only health information that has been printed on paper and stored in a locked file room
D. Any medical research data, regardless of whether it can be linked to a specific person
Show answer and reasoning
Correct answer: B. Individually identifiable health information held or transmitted by a covered entity or business associate, in any form or medium
Correct. 45 CFR 160.103 defines PHI as individually identifiable health information that is transmitted or maintained by a covered entity or business associate in any form, electronic, paper, or oral.
- A: Employment and payroll records about a covered entity's own staff, in their role as employer, are generally excluded from PHI under the employment records exception.
- C: PHI is not limited to paper records; it includes electronic PHI (ePHI) and oral communications as well.
- D: De-identified research data that cannot reasonably be used to identify an individual falls outside the PHI definition.
Source: 45 CFR 160.103 - Definitions (Protected Health Information)
For health information to qualify as 'individually identifiable' under HIPAA, it must do which of the following?
A. Contain a Social Security number
B. Relate to the past, present, or future health, treatment, or payment of an individual, and either identify the individual or provide a reasonable basis to identify them
C. Be stored in an electronic health record system
D. Have been created by a physician rather than a nurse or technician
Show answer and reasoning
Correct answer: B. Relate to the past, present, or future health, treatment, or payment of an individual, and either identify the individual or provide a reasonable basis to identify them
Correct. 45 CFR 160.103 ties individually identifiable health information to its relation to health status, care, or payment, combined with identifying information or a reasonable basis to identify the person.
- A: A Social Security number is one possible identifier, but its presence is not required for information to be individually identifiable.
- C: The medium (electronic, paper, or oral) does not determine whether information is individually identifiable.
- D: The creator's job title or credential does not affect whether information meets the identifiability standard.
Source: 45 CFR 160.103 - Definitions (Individually Identifiable Health Information)
A home health aide overhears a patient's diagnosis while providing care in the patient's home and later repeats it to a coworker without authorization. Is this information PHI?
A. No, because it was communicated orally rather than in writing
B. No, because it was not generated inside a hospital or clinic building
C. Yes, because PHI includes individually identifiable health information in oral form, regardless of where the care is delivered
D. Yes, but only if the patient signed a written authorization beforehand
Show answer and reasoning
Correct answer: C. Yes, because PHI includes individually identifiable health information in oral form, regardless of where the care is delivered
Correct. HIPAA's definition of PHI under 45 CFR 160.103 covers individually identifiable health information in any form, including spoken words, and applies wherever a covered entity's workforce provides services.
- A: PHI protections apply to oral communications, not just written or electronic records.
- B: The location where care is delivered does not remove information from PHI protection.
- D: Whether the patient signed an authorization affects whether a disclosure is permitted, not whether the underlying information qualifies as PHI in the first place.
Source: 45 CFR 160.103; 164.501 - Definitions
A hospital's HR department keeps a file on a nurse documenting her sick leave requests submitted as part of her employment with the hospital. Under HIPAA, this file is generally treated as:
A. PHI, because it references a health-related absence
B. Not PHI, because it falls within the employment records exception when held by the covered entity in its role as employer
C. PHI only if the nurse also happens to be a patient of the hospital
D. Not PHI, because HR files are never covered by any federal privacy law
Show answer and reasoning
Correct answer: B. Not PHI, because it falls within the employment records exception when held by the covered entity in its role as employer
Correct. Under 45 CFR 160.103, PHI excludes employment records held by a covered entity in its role as employer, such as sick leave documentation maintained by HR.
- A: Health-related content alone does not make a record PHI; the employment records exception carves out records a covered entity holds in its capacity as an employer.
- C: The nurse's separate status as a patient in a different context does not change how her own employment file is classified.
- D: Other federal and state employment laws, such as the ADA and FMLA, may still govern the confidentiality of HR files even though HIPAA's PHI definition does not apply to them.
Source: 45 CFR 160.103 - Definitions (Employment Records Exception)
Which of the following organizations meets the HIPAA definition of a 'covered entity'?
A. A health care clearinghouse that processes standard electronic transactions
B. A parking garage attached to a hospital
C. A vendor that manufactures hospital beds
D. A newspaper that reports on local health department statistics
Show answer and reasoning
Correct answer: A. A health care clearinghouse that processes standard electronic transactions
Correct. 45 CFR 160.103 identifies three categories of covered entities: health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction.
- B: A parking facility does not create, receive, maintain, or transmit PHI as part of health care operations and is not a covered entity.
- C: A hospital bed manufacturer selling equipment does not, by that activity alone, become a covered entity.
- D: A news organization reporting publicly available statistics is not a health plan, clearinghouse, or health care provider.
Source: 45 CFR 160.103 - Definitions (Covered Entity)
