Free Maryland HIPAA Practice Test Online

Correct answer: B. A business associate, because it performs a service involving PHI on behalf of a covered entity

Correct — 45 CFR 160.103 defines a business associate as a person or entity that performs a function or service on behalf of a covered entity involving the use or disclosure of PHI, which requires a business associate agreement.

• A: Wrong — a covered entity is a health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction; a transcription vendor is not any of these.
• C: Wrong — workforce members are employees, volunteers, or trainees under the direct control of the covered entity; an outside vendor company is a separate legal entity, not part of the hospital's workforce.
• D: Wrong — handling PHI to perform a service for a covered entity is exactly the situation HIPAA's business associate provisions were written to cover; there is no administrative-task exemption.

Correct answer: A. The minimum necessary standard

Correct — 164.502(b) requires covered entities to make reasonable efforts to limit PHI use, disclosure, or requests to the minimum necessary to accomplish the intended purpose; pulling full notes for a billing task exceeds what is needed.

• B: Wrong — right of access (164.524) governs a patient's own right to obtain their records, not an employee's internal data pull.
• C: Wrong — the notice of privacy practices is the patient-facing document describing privacy practices; it is unrelated to internal access scope.
• D: Wrong — de-identification (164.514) is about stripping identifiers from a data set, not about limiting the amount of identifiable data an employee accesses for a task.

Correct answer: C. No, because this is a disclosure for treatment purposes, which is permitted without authorization

Correct — 164.506(c) permits covered entities to use or disclose PHI for treatment, payment, and health care operations without patient authorization, and a referral for consultation is treatment.

• A: Wrong — a blanket authorization rule is incorrect; treatment, payment, and health care operations (TPO) disclosures are specifically exempted from the authorization requirement.
• B: Wrong — the treatment exception is not limited to same-system providers; it applies to any provider involved in the patient's treatment.
• D: Wrong — no on-the-spot verbal agreement is legally required for a treatment disclosure under 164.506(c); the rule does not condition it on point-of-service consent.

Correct answer: D. A valid, patient-signed authorization that specifically describes this marketing use

Correct — 164.508 requires a valid authorization meeting the core elements in 164.508(c) (a specific description of the PHI, purpose, recipient, and expiration) before PHI is used for marketing.

• A: Wrong — taking the photo during treatment doesn't authorize an unrelated marketing use; marketing use is one of the situations 164.508(a) singles out as requiring specific authorization.
• B: Wrong — HIPAA authorization for marketing must be a signed, specific document, not an informal verbal note in the chart.
• C: Wrong — the general treatment consent obtained at admission covers TPO activities, not marketing uses, which require their own authorization.

Correct answer: B. No, this is a permissible incidental disclosure because reasonable safeguards were used

Correct — 164.502(a)(1)(iii) permits incidental disclosures that occur as a by-product of a permitted communication, as long as the covered entity applied reasonable safeguards and minimum necessary practices, such as lowering voices near a nursing station.

• A: Wrong — not every overheard exchange is a violation; the incidental use/disclosure provision recognizes that some incidental exposure is unavoidable.
• C: Wrong — HIPAA does not require every clinical conversation to occur in a locked room; that would be an unreasonable operational burden the rule doesn't impose.
• D: Wrong — the rule's protection doesn't depend on the visitor's subjective expectation of privacy; it depends on whether the covered entity used reasonable safeguards, which it did here.