What is the general rule that opens 45 CFR 164.502, "Uses and disclosures of protected health information: general rules"?
A. A covered entity or business associate may not use or disclose PHI except as the Privacy Rule permits or requires
B. A covered entity may use or disclose PHI for any business purpose it decides is reasonable
C. PHI may be freely shared among all workforce members regardless of job function
D. PHI may be disclosed to anyone who requests it in writing
Source: 45 CFR 164.502(a)
Under HIPAA, "protected health information" (PHI) is individually identifiable health information that is:
A. Transmitted or maintained in electronic media, or transmitted or maintained in any other form or medium
B. Only information stored in an electronic medical record system
C. Only information a patient has explicitly labeled as confidential
D. Only information about a diagnosis, never about payment for care
Source: 45 CFR 160.103 (definition of protected health information)
Under 45 CFR 160.103, what is the key difference between a "use" and a "disclosure" of PHI?
A. A "use" is sharing information within the entity that maintains it; a "disclosure" is releasing it outside that entity
B. A "use" always requires patient authorization, while a "disclosure" never does
C. There is no legal distinction; the terms are interchangeable
D. A "use" applies only to paper records, and a "disclosure" applies only to electronic records
Source: 45 CFR 160.103 (definitions of use and disclosure)
Under 45 CFR 160.103, who counts as a member of a covered entity's "workforce"?
A. Employees, volunteers, trainees, and other persons whose work conduct is under the direct control of the covered entity or business associate, whether or not they are paid
B. Only salaried, full-time employees
C. Only individuals who have signed a business associate agreement
D. Only clinical staff who directly treat patients
Source: 45 CFR 160.103 (definition of workforce)
A billing company that processes claims on behalf of a physician practice, and in doing so creates and transmits PHI, is best described under HIPAA as:
A. A business associate of the physician practice
B. A covered entity in its own right, identical in status to the practice
C. Part of the practice's workforce
D. Exempt from HIPAA because it does not provide direct patient care
Source: 45 CFR 160.103 (definitions of covered entity and business associate)
