Free Nevada HIPAA Practice Test Online

Correct answer: B. 45 CFR Parts 160, 162, and 164

Correct. HIPAA's Administrative Simplification regulations, including the Privacy Rule, Security Rule, and transaction/code set standards, are codified at 45 CFR Parts 160, 162, and 164.

• A: Wrong. 29 CFR Part 1910 covers OSHA general industry workplace safety standards, not HIPAA privacy or security requirements.
• C: Wrong. 21 CFR Part 11 governs FDA electronic records and signatures, a separate regulatory scheme from HIPAA.
• D: Wrong. 42 CFR Part 2 is a distinct, stricter federal rule for substance use disorder treatment records; it supplements but does not replace the general HIPAA framework.

Correct answer: B. A business associate, because it creates or receives PHI to perform a function on the clinic's behalf

Correct. Under 45 CFR 160.103, an entity that creates or receives PHI to perform a function or service on behalf of a covered entity, such as transcription, is a business associate and must operate under a business associate agreement.

• A: Wrong. The transcription company does not itself provide treatment, bill for care, or administer a health plan, so it does not meet the definition of a covered entity.
• C: Wrong. Handling identifiable clinical documentation on a covered entity's behalf brings the company within HIPAA's business associate definition; it is not exempt.
• D: Wrong. Business associates have direct compliance obligations under the HIPAA Security Rule and portions of the Privacy Rule, not merely obligations flowing through a contract with no independent liability.

Correct answer: B. Employees, volunteers, trainees, and other persons whose conduct is under the direct control of the covered entity, whether or not they are paid

Correct. 45 CFR 160.103 defines workforce broadly to include employees, volunteers, trainees, and other persons under the direct control of a covered entity or business associate, regardless of whether they are paid.

• A: Wrong. Limiting "workforce" to paid W-2 employees excludes volunteers and trainees, who are explicitly included under 45 CFR 160.103.
• C: Wrong. Workforce is not limited to governance-level personnel; it covers the much broader population under the entity's direct control.
• D: Wrong. Non-clinical staff, such as billing, scheduling, and IT personnel who access PHI, are also part of the workforce under this definition.

Correct answer: B. A hospital's internal record of an employee's own workers' compensation claim, held in its capacity as employer

Correct. Employment records a covered entity holds in its role as an employer, such as an employee's own workers' compensation file maintained for HR purposes, are specifically excluded from the PHI definition under 45 CFR 160.103.

• A: Wrong. A lab result tied to an identifiable patient is individually identifiable health information and qualifies as PHI.
• C: Wrong. A diagnosis tied to a specific patient in a clinical note is a textbook example of PHI.
• D: Wrong. An insurance claim form documenting a patient's treatment history and identity is individually identifiable health information and qualifies as PHI.

Correct answer: B. Access only the insurance and billing information needed to verify coverage for the specific claim

Correct. 45 CFR 164.502(b) requires limiting PHI access to the minimum necessary to accomplish the specific purpose, which here is verifying insurance coverage for billing.

• A: Wrong. Pulling the entire medical history, including unrelated visits, goes well beyond what is needed to verify insurance coverage.
• C: Wrong. Psychotherapy notes are subject to heightened protection and are entirely unnecessary for a routine coverage verification task.
• D: Wrong. Contacting family members is unrelated and unnecessary to verifying insurance coverage, and it risks an improper disclosure to a third party.