Free Louisiana HIPAA Practice Test Online

Correct answer: D. 30 calendar days, with one possible 30-day extension

Correct. 45 CFR 164.524 requires a response within 30 calendar days of the request, with one 30-day extension allowed if the entity provides written notice of the reason for delay.

• A: 10 days is not the HIPAA standard; it understates the compliance window.
• B: 90 days overstates the allowed time; the base period is 30 days, extendable once by 30 more days.
• C: The rule uses calendar days, not business days, and 60 is not the base timeframe (it is the maximum with the extension applied).

Correct answer: A. A health plan that pays claims for enrollees

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction.

• B: A hosting vendor that handles PHI on behalf of a covered entity is a business associate, a separate regulatory category with its own obligations, not a covered entity itself.
• C: A janitorial service is typically a conduit/incidental contact and, absent PHI access as part of its function, is not a business associate or covered entity.
• D: Family members assisting with care are not regulated entities under HIPAA; HIPAA governs covered entities and business associates, not individuals acting in a personal capacity.

Correct answer: B. Business associate

Correct. Under 45 CFR 160.103, a business associate is a person or entity that performs functions or services involving PHI on behalf of a covered entity, such as claims processing, and must operate under a business associate agreement per 164.504(e).

• A: The physician practice, not the billing company, is the covered entity in this relationship.
• C: A hybrid entity is a single legal entity that performs both covered and non-covered functions internally; that concept does not apply to an outside vendor.
• D: A personal representative is someone authorized under applicable law to act on behalf of an individual patient in health care decisions, unrelated to a vendor relationship.

Correct answer: C. An individually identifiable medical record maintained by a health care provider

Correct. PHI under 45 CFR 160.103 is individually identifiable health information created or received by a covered entity and held or transmitted in any form.

• A: Aggregate statistics with no individual identifiers do not meet the 'individually identifiable' element of the PHI definition.
• B: Properly de-identified data under the Safe Harbor or Expert Determination methods of 164.514 is expressly excluded from PHI.
• D: HIPAA explicitly excludes employment records held by a covered entity in its role as an employer from the definition of PHI.

Correct answer: D. Limit uses, disclosures, and requests for PHI to the minimum needed to accomplish the intended purpose

Correct. 164.502(b) and 164.514(d) require covered entities to make reasonable efforts to limit PHI use/disclosure/requests to the minimum necessary for the purpose.

• A: Minimum necessary is a scope-of-access limitation, not an authorization requirement; many routine uses (like treatment) don't require authorization at all.
• B: HIPAA does not set a blanket 30-day destruction requirement; retention is governed by other laws and organizational policy, not the minimum necessary standard.
• C: Encryption is a technical safeguard addressed under the Security Rule (164.312), a separate requirement from minimum necessary.