Free Maine HIPAA Practice Test Online

Correct answer: A. A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who conduct certain transactions electronically.

• B: Generic paper storage for any client is not, by itself, a covered entity or business associate function.
• C: A vitamin retailer is not a HIPAA covered entity absent a qualifying health care/health plan function.
• D: A general gym tracking workouts (not through a covered health plan or provider) is not a covered entity.

Correct answer: B. Business associate

Correct. A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity, performing a covered function such as claims processing, is a business associate under 45 CFR 160.103.

• A: The physician's office is the covered entity; the billing company performing a function on its behalf using PHI is a business associate.
• C: This is a defined regulatory relationship (business associate), not merely a beneficiary status.
• D: A billing vendor is not a patient representative.

Correct answer: A. Processes nonstandard health information into a standard format (or vice versa) for another entity

Correct. A clearinghouse translates data between standard and nonstandard formats, such as converting claims data for electronic transactions.

• B: Device manufacturing is unrelated to the clearinghouse definition.
• C: Providing insurance describes a health plan, a separate covered entity category.
• D: Facilities maintenance is unrelated to the clearinghouse function.

Correct answer: B. May fall outside HIPAA's covered entity definition if no covered electronic transactions occur

Correct. HIPAA's covered entity definition for providers hinges on conducting certain transactions electronically in connection with standard transactions; a provider who never does so may fall outside that definition.

• A: Coverage turns on whether the provider conducts standard electronic transactions, not merely on being a provider.
• C: This does not create a blanket exemption from all privacy law; other laws may still apply.
• D: There is no HIPAA requirement for such 'annual registration' as a covered entity.

Correct answer: B. Themselves treated as business associates, subject to HIPAA's business associate obligations

Correct. HIPAA extends business associate obligations down the chain to subcontractors who handle PHI on behalf of a business associate.

• A: Subcontractors handling PHI on a business associate's behalf are not outside HIPAA's reach.
• C: Subcontractors are business associates, not covered entities, absent an independent covered entity function.
• D: Company size does not exempt a subcontractor handling PHI from business associate obligations.