Free Illinois HIPAA Practice Test Online

Correct answer: B. The nature of the information to be disclosed in detail, and the duration of the consent.

• A: Naming the therapist alone does not satisfy the Act's requirement that the specific nature of the disclosed information and duration be stated.
• C: The Act does not permit open-ended blanket consent; it requires the consent to specify both the detailed nature of the information and a duration.
• D: A bare signature without specifying detail and duration does not meet the Act's advance-consent requirements.

Correct answer: B. Only to the individual tested and to persons specifically authorized in writing by that individual to receive the information.

• A: An employer request alone does not authorize release under GIPA; only the tested individual's specific written authorization does.
• C: Health insurers are not automatically entitled to genetic test results under GIPA absent the individual's specific written authorization.
• D: An informal law enforcement request does not satisfy GIPA's requirement of specific written authorization from the tested individual.

Correct answer: A. The employer must obtain a signed written release from the employee and inform the employee in writing of the purpose and length of the collection and storage.

• B: A general web-posted policy alone does not satisfy BIPA's requirement of a specific written release before collection.
• C: BIPA requires informed written consent before collection, not after the fact.
• D: Using the data for payroll does not exempt an employer from BIPA's written-release requirement; the health-care exemption in the Act applies to patient treatment information, not employee timeclock data.

Correct answer: B. When the initial purpose for collection has been satisfied, or within 3 years of the individual's last interaction with the entity, whichever occurs first.

• A: BIPA does not set a fixed 90-day deadline; the statutory retention limit is tied to purpose satisfaction or a 3-year outer limit.
• C: Destruction is not conditioned on an employee's request; the retention schedule and destruction obligation are mandatory and self-executing under the statute.
• D: Encryption does not exempt an entity from BIPA's mandatory retention-and-destruction-schedule requirement.

Correct answer: C. The patient check-in use is exempt because it is information collected for health care treatment, payment, or operations; the employee timeclock use is not exempt and remains subject to BIPA.

• A: This is incorrect because the statutory definition specifically excludes information captured in a health care treatment/payment/operations context.
• B: This reverses the actual exemption; the exemption in 740 ILCS 14/10 covers patient treatment-related biometric information, not employee timekeeping data.
• D: Being a HIPAA covered entity does not blanket-exempt a hospital's employment-related biometric collection from BIPA; the exemption is tied to the health-care-treatment purpose of the data, not the entity's HIPAA status.