Free Indiana HIPAA Practice Test Online

Correct answer: D. Disclosure for treatment purposes by a healthcare provider

This is correct. 45 CFR 164.502(a)(1)(ii) permits covered entities to use and disclose PHI for treatment, payment, and healthcare operations without authorization.

• A: Incorrect. Media disclosure is not a permitted purpose under 45 CFR 164.502 and would require specific authorization.
• B: Incorrect. Employment decisions are not a permitted purpose under 45 CFR 164.502. Only treatment, payment, and healthcare operations are permitted without authorization.
• C: Incorrect. Life insurance underwriting is not a permitted purpose under 45 CFR 164.502. Authorization would be required for non-treatment uses.

Correct answer: D. Limit the information to the amount reasonably needed to accomplish the intended purpose

This is correct. 45 CFR 164.502(b) requires covered entities to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose.

• A: Incorrect. Patient notification is not a requirement of the minimum necessary standard under 45 CFR 164.502(b).
• B: Incorrect. While separate systems may help with security, the minimum necessary standard is about the amount of information disclosed, not system architecture.
• C: Incorrect. Disclosing all available information contradicts the minimum necessary standard, which explicitly limits disclosure to what is needed.

Correct answer: D. A description of each purpose for the requested use or disclosure

This is correct. 45 CFR 164.508(b) requires that any authorization include a description of each purpose of the requested use or disclosure.

• A: Incorrect. Authorizations must specify the purpose and cannot be for future unlimited uses. 45 CFR 164.508(b) requires specific purposes and conditions.
• B: Incorrect. 45 CFR 164.506(b)(4) prohibits conditioning treatment on authorization for uses unrelated to treatment, payment, or healthcare operations.
• C: Incorrect. There is no HIPAA requirement to notify an employer about authorizations or disclosures related to the patient's health information.

Correct answer: D. 30 days from the date of the request, with one possible 30-day extension

This is correct. 45 CFR 164.524(b)(2) requires covered entities to provide access within 30 days of the request, which can be extended once for 30 additional days.

• A: Incorrect. The timeframe is 30 days maximum per 45 CFR 164.524(b)(2), not 60 days.
• B: Incorrect. 45 CFR 164.524 specifies 30 days, not 10 business days. The regulation allows for extensions beyond 10 days.
• C: Incorrect. 45 CFR 164.524 requires a written request and documented response within the specified timeframe.

Correct answer: C. Medical records, billing records, and payment and claims records

This is correct. 45 CFR 164.524(a)(2) defines designated record sets to include medical records, billing records, payment and claims records, and other records used to make decisions.

• A: Incorrect. Psychotherapy notes have specific limitations under 45 CFR 164.524(a)(1), and providers may deny access in limited circumstances.
• B: Incorrect. Billing and payment records are specifically included in the designated record set under 45 CFR 164.524(a)(2) and must be provided upon request.
• D: Incorrect. 45 CFR 164.524 does not limit access requests to only recent records. Individuals have access rights to all records in the designated record set.