Free New Hampshire HIPAA Practice Test Online

Correct answer: A. A health plan that pays claims for enrollees

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction.

• B: A hosting vendor that handles PHI on behalf of a covered entity is a business associate, a separate category, not a covered entity itself.
• C: A janitorial service with only incidental contact is generally not a business associate or covered entity.
• D: Family members assisting with care are not regulated entities under HIPAA.

Correct answer: B. Business associate

Correct. A transcription service that creates, receives, or maintains PHI on behalf of a covered entity performs a business associate function under 45 CFR 160.103.

• A: The hospital, not the transcription vendor, is the covered entity here.
• C: A hybrid entity is a single legal entity with both covered and non-covered functions internally; that does not describe an outside vendor.
• D: A clearinghouse processes nonstandard health information into standard transactions; a transcription service does not.

Correct answer: C. An employer's human resources department maintaining its own personnel files

Correct. An employer acting as an employer (not as a group health plan sponsor) is not a covered entity; employment records held in that capacity are excluded from HIPAA regulation.

• A: Hospitals transmitting standard electronic transactions are covered health care providers.
• B: Dental offices billing insurers electronically meet the covered provider definition.
• D: Pharmacies transmitting electronic claims are covered health care providers.

Correct answer: B. Itself a business associate, subject to the same requirements as the entity that hired it

Correct. Under 45 CFR 160.103 and 164.308(b)(1), a subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate is itself a business associate.

• A: HIPAA extends business associate obligations down the subcontractor chain; there is no exemption for lacking a direct relationship with the covered entity.
• C: There is no dollar threshold exemption in the business associate definition.
• D: A subcontractor is a separate legal business associate, not absorbed into the covered entity.

Correct answer: C. An individually identifiable medical record maintained by a health care provider

Correct. PHI under 45 CFR 160.103 is individually identifiable health information created or received by a covered entity, held or transmitted in any form.

• A: Aggregate statistics with no individual identifiers are not individually identifiable.
• B: Properly de-identified data under 164.514 is expressly excluded from PHI.
• D: HIPAA excludes employment records held by a covered entity in its employer role from the definition of PHI.