Free Nebraska HIPAA Practice Test Online

Correct answer: A. Held or transmitted by a covered entity or business associate, in any form or medium

Correct. 45 CFR 160.103 defines PHI as individually identifiable health information transmitted or maintained by a covered entity or business associate in any form (electronic, paper, or oral).

• B: Incorrect. PHI is not limited to electronic records; paper charts and oral communications of identifiable health information are also PHI.
• C: Incorrect. An SSN is one possible identifier but is not required for information to qualify as PHI.
• D: Incorrect. A consumer app not operated by or on behalf of a covered entity generally falls outside HIPAA's PHI definition.

Correct answer: B. A lab report showing a named patient's blood glucose result

Correct. A lab report tied to a specific named patient relates to that person's health condition and identifies them, meeting the definition.

• A: Incorrect. Properly de-identified data is expressly excluded from PHI.
• C: Incorrect. Aggregate statistics that do not identify an individual are not individually identifiable health information.
• D: Incorrect. A report without patient identifiers does not meet the individually identifiable standard.

Correct answer: A. Employment records held by a covered entity in its role as an employer

Correct. 45 CFR 160.103 excludes employment records held by a covered entity in its capacity as an employer from PHI.

• B: Incorrect. A discharge summary is clinical information tied to an identifiable patient and is PHI.
• C: Incorrect. A pharmacy prescription record is PHI because it reflects treatment for an identifiable individual.
• D: Incorrect. A claim form submitted to a health plan is PHI because it contains identifiable health and payment information.

Correct answer: A. Any information, including genetic information, relating to a person's past, present, or future physical or mental health condition

Correct. HIPAA's definition of health information is broad and includes genetic information and data about physical or mental health condition, health care provided, or payment for care.

• B: Incorrect. Billing codes are one narrow example, not the full definition.
• C: Incorrect. Health information can be created by many types of providers and staff, not only physicians.
• D: Incorrect. Health information covers outpatient, home health, and many other settings, not just inpatient stays.

Correct answer: A. A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who conduct certain electronic transactions.

• B: Incorrect. Merely storing data does not by itself make an entity a covered entity; it may instead be a business associate depending on its role.
• C: Incorrect. Family caregivers acting in a personal, non-professional capacity are not covered entities.
• D: Incorrect. A vendor that has never handled PHI has not taken on business associate obligations.