Free Kentucky HIPAA Practice Test Online

Correct answer: D. A physician disclosing PHI to another physician for treatment purposes

Correct. 45 CFR 164.502(b)(2) exempts disclosures to health care providers for treatment purposes because clinicians need full clinical context to treat patients effectively.

• A: Wrong. Research disclosures are generally still subject to minimum necessary review or an IRB/Privacy Board waiver process.
• B: Wrong. Routine operational disclosures to business associates remain subject to minimum necessary and must be governed by a business associate agreement.
• C: Wrong. Marketing disclosures are not exempt and typically require patient authorization in addition to minimum necessary limits.

Correct answer: A. A patient's name and diagnosis stored in a covered entity's medical record system

Correct. Individually identifiable health information created or received by a covered entity and held or transmitted in any form is PHI under 45 CFR 160.103.

• B: Wrong. Properly de-identified information under the Safe Harbor or Expert Determination method is, by definition, no longer PHI and falls outside the Privacy Rule.
• C: Wrong. Aggregate statistics with no individual identifiers cannot be traced to a specific person and do not meet the 'individually identifiable' element of the PHI definition.
• D: Wrong. A tax filing is a business record, not health information about an individual, so it is not PHI regardless of who files it.

Correct answer: B. Transmits health information in electronic form in connection with a HIPAA standard transaction

Correct. The 45 CFR 160.103 definition of covered entity turns on whether the provider transmits health information electronically in connection with a standard transaction, such as billing a claim.

• A: Wrong. Covered entity status has nothing to do with workforce size; a solo practitioner can be a covered entity.
• C: Wrong. Covered entity status is not limited by geographic scope; entities in multiple states are still covered.
• D: Wrong. A provider that bills patients directly can still be a covered entity if it conducts any standard electronic transaction, such as eligibility checks.

Correct answer: C. Only the demographic and insurance information needed to verify coverage

Correct. 45 CFR 164.502(b) requires covered entities to limit PHI use, disclosure, and requests to the minimum necessary to accomplish the intended purpose, here just coverage verification.

• A: Wrong. Psychotherapy notes receive heightened protection and are excluded from routine minimum necessary access; the full record also far exceeds what billing verification requires.
• B: Wrong. A decade of treatment history is unrelated to confirming insurance eligibility and violates the minimum necessary standard.
• D: Wrong. Bulk access to unrelated patients' records for convenience is exactly the kind of overbroad access the minimum necessary standard is designed to prevent.

Correct answer: A. Sharing a patient's record with another treating provider for care coordination

Correct. 45 CFR 164.506 permits covered entities to use or disclose PHI without authorization for treatment, payment, and health care operations, which includes coordinating care with another treating provider.

• B: Wrong. Paid marketing communications almost always require specific patient authorization under the Privacy Rule.
• C: Wrong. Disclosures to life insurers for underwriting are not treatment, payment, or operations and generally require signed authorization.
• D: Wrong. Public social media posting is a disclosure with no TPO basis and requires explicit written authorization.