Free Minnesota HIPAA Practice Test Online

Correct answer: C. Without unreasonable delay and in no case later than 60 calendar days after discovery

Correct. 45 CFR 164.404 requires notification to affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach.

• A: Incorrect. HIPAA's standard is expressed in calendar days, not business days, with an outer limit of 60 calendar days.
• B: Incorrect. 45 CFR 164.404 sets a firm outer limit of 60 calendar days; there is no open-ended deadline.
• D: Incorrect. The regulatory maximum is 60 calendar days, not 90.

Correct answer: C. Only the insurance and demographic information needed to verify coverage

Correct. 45 CFR 164.502(b) requires covered entities to limit PHI access to the minimum necessary to accomplish the intended purpose, which here is confirming coverage.

• A: Incorrect. Accessing other family members' full charts is unrelated to verifying the named patient's coverage and is not minimally necessary.
• B: Incorrect. Pulling the complete chart, especially psychotherapy notes, exceeds what is needed for an insurance verification task and violates the minimum necessary standard.
• D: Incorrect. Ten years of unrelated visit notes are not needed to verify current insurance coverage.

Correct answer: A. Business associate, because it creates or maintains PHI on behalf of a covered entity

Correct. 45 CFR 160.103 defines a business associate as a person or entity that creates, receives, maintains, or transmits PHI to perform a function or activity on behalf of a covered entity, which includes transcription services.

• B: Incorrect. Hybrid entity status applies to a single covered entity that designates some of its own internal components as covered and others as non-covered; it does not describe an outside vendor.
• C: Incorrect. Lack of direct patient contact does not exempt a vendor from HIPAA; handling PHI on behalf of a covered entity triggers business associate obligations regardless of patient contact.
• D: Incorrect. The transcription company does not itself provide treatment, bill health plans, or administer a health plan; it performs a function for the physician group, which is the defining feature of a business associate.

Correct answer: B. A patient's name linked to a lab result in the hospital's system

Correct. Individually identifiable health information created or received by a covered entity, such as a patient's name tied to a lab result, meets the 45 CFR 160.103 definition of PHI.

• A: Incorrect. Employment records a covered entity holds in its role as an employer are specifically excluded from the definition of PHI under 45 CFR 160.103.
• C: Incorrect. A parking log with license plates is not health information and was not created or received in connection with the individual's health care.
• D: Incorrect. Aggregate statistics with no identifiers do not meet the individually identifiable standard required for PHI.

Correct answer: D. A disclosure to a specialist for the purpose of treating the patient

Correct. 45 CFR 164.502(b)(2) exempts disclosures to health care providers for treatment purposes from the minimum necessary standard because treating clinicians need full clinical context.

• A: Incorrect. Marketing communications are not treatment disclosures, so the minimum necessary standard still applies, and marketing generally also requires patient authorization.
• B: Incorrect. Internal compliance reviews remain subject to minimum necessary; access should be limited to what the audit actually requires.
• C: Incorrect. Research access is not automatically exempt; it generally requires a minimum necessary determination, IRB/Privacy Board waiver, individual authorization, or a data use agreement.