Which of the following would generally be considered PHI?
A. A de-identified data set with all identifiers permanently removed per the Safe Harbor method
B. A patient's name linked to their diagnosis in a hospital record
C. Aggregate statistics with no way to identify any individual
D. A phone book listing with no health information
Source: 45 CFR 160.103 - Definitions (protected health information)
For routine, recurring disclosures of PHI, a covered entity's minimum necessary compliance approach typically involves:
A. Reviewing every single disclosure individually with no standard criteria
B. Implementing policies and procedures (such as standard protocols) that limit the PHI disclosed to what is reasonably necessary
C. Disclosing complete records by default to save time
D. Ignoring the requirement for recurring disclosures since they happen often
Source: 45 CFR 164.502(b), 164.514(d) - Minimum necessary requirement
Role-based access controls limiting which staff can view specific categories of PHI in an EHR system are an example of implementing:
A. The right to request restrictions
B. The minimum necessary standard
C. The breach notification rule
D. The right to amend
Source: 45 CFR 164.502(b), 164.514(d) - Minimum necessary requirement
A valid HIPAA authorization for release of PHI must include which of the following core elements?
A. A description of the information to be disclosed, who may disclose and receive it, and an expiration date or event
B. Only the patient's verbal consent with no written form
C. The treating physician's personal opinion of the patient
D. A blank form to be filled in later by office staff
Source: 45 CFR 164.508 - Uses and disclosures requiring an authorization
Under 45 CFR 164.528, an individual generally has the right to receive an accounting of disclosures of their PHI made by a covered entity going back how far?
A. The prior 6 years before the date of the request
B. Only the prior 30 days
C. The individual's entire lifetime with no limit
D. Only disclosures made after a lawsuit is filed
Source: 45 CFR 164.528 - Accounting of disclosures
