Free Oklahoma HIPAA Practice Test Online

Correct answer: B. Up to six years prior to the date of the request

Correct. 45 CFR § 164.528 gives individuals the right to an accounting of certain disclosures made in the six years prior to the request date, excluding disclosures for treatment, payment, and health care operations and a few other categories.

• A: Wrong. 30 days is far shorter than the six-year period established by the regulation.
• C: Wrong. The regulation caps the accounting period at six years; it is not unlimited.
• D: Wrong. Limiting the accounting to the current calendar year would not satisfy the six-year lookback required by the rule.

Correct answer: A. Protected Health Information (PHI), because it is individually identifiable health information held by a covered entity

Correct. Under 45 CFR § 160.103, PHI is individually identifiable health information transmitted or maintained by a covered entity in any form, and a name linked to a diagnosis meets that definition.

• B: Wrong. De-identification requires removing specific identifiers under 45 CFR § 164.514(b); simply storing data in a billing system does not de-identify it.
• C: Wrong. Health information tied to an identifiable patient is confidential under HIPAA regardless of which department or system holds it.
• D: Wrong. The employment-records carve-out in 45 CFR § 160.103 applies only to records a covered entity holds in its role as an employer, not to patient billing data.

Correct answer: B. Only the information reasonably needed to verify coverage for that visit, such as the visit date and billing codes

Correct. 45 CFR § 164.502(b) requires covered entities to limit use of PHI to the amount reasonably necessary to accomplish the specific purpose, which here is verifying coverage for one visit.

• A: Wrong. Pulling the complete cross-provider history for a single coverage check exceeds what is reasonably necessary.
• C: Wrong. Accessing unrelated psychiatric records has no bearing on verifying coverage for a different visit and violates minimum necessary.
• D: Wrong. Convenience is not the standard; the workforce member must limit access to what the specific task requires.

Correct answer: C. A physician sending a patient's full chart to a specialist for treatment purposes

Correct. 45 CFR § 164.502(b)(2) exempts disclosures to a health care provider for treatment from the minimum necessary requirement, since clinicians need full clinical context to treat patients.

• A: Wrong. Marketing uses are not treatment, payment, or health care operations exempt activities and generally require an authorization under 45 CFR § 164.508(a)(3).
• B: Wrong. Disclosure to an employer for hiring decisions is not a treatment exception and would require the individual's authorization.
• D: Wrong. Research access without an authorization or a proper IRB/Privacy Board waiver is not a recognized minimum necessary exception.

Correct answer: D. A health plan that pays for or provides the cost of medical care

Correct. 45 CFR § 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction.

• A: Wrong. Life insurers are not health plans under the HIPAA definition and are excluded from the covered entity category.
• B: Wrong. A vendor hosting PHI on behalf of a covered entity is a business associate, not a covered entity itself.
• C: Wrong. An employer receiving leave paperwork is acting in its employment capacity, which HIPAA does not regulate as a covered entity function.