Free Massachusetts HIPAA Practice Test Online

Correct answer: C. A health insurance company that uses medical information to underwrite policies.

Health insurance companies (health plans) are explicitly listed as covered entities in 45 CFR 164.102.

• A: Retail vitamin sellers are not covered entities; they do not handle protected health information.
• B: Medical device manufacturers are not covered entities; they do not handle patient health information.
• D: Life coaches who do not handle health information are not covered entities.

Correct answer: B. Because it receives, maintains, or transmits protected health information on behalf of the covered entity.

This is the correct definition of a business associate under 45 CFR 160.103.

• A: General IT services that do not involve access to protected health information do not create a business associate relationship.
• C: Selling software licenses is a commercial relationship, not a business associate function.
• D: Geographic proximity has no bearing on business associate status.

Correct answer: B. Only the patient's name, address, phone number, and account balance owed.

This represents the minimum necessary information to accomplish the billing function per 45 CFR 164.502(b).

• A: Medical history is not needed to collect a bill and violates the minimum necessary principle.
• C: Test results and diagnoses are not needed for billing purposes.
• D: While insurance information may be useful, the patient's name, address, and account balance are the true minimum necessary.

Correct answer: D. 30 days, with a possible 30-day extension if access cannot be provided within the initial timeframe.

45 CFR 164.524(b)(2)(i) requires response within 30 days, with a possible 30-day extension.

• A: The regulation specifies a required timeline; lack of a deadline is not compliant.
• B: While best practice, immediate provision is not the regulatory requirement.
• C: 90 days exceeds the required timeframe.

Correct answer: C. Conducting a security risk analysis and documenting findings in a formal written report.

Security risk analysis and formal documentation are administrative safeguards per 45 CFR 164.308(a)(1)(ii).

• A: Encryption is a technical safeguard.
• B: Firewalls are technical safeguards, not administrative safeguards.
• D: Motion-sensor locks are physical safeguards.