Free Oregon HIPAA Practice Test Online

Correct answer: A. A health plan that pays claims for its enrollees' medical care

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and health care providers who transmit health information electronically for a covered transaction.

• B: Wrong. A janitorial vendor with only incidental exposure to PHI performing a service unrelated to health data does not meet any of the three covered-entity categories.
• C: Wrong. A transcription vendor creates PHI on a provider's behalf, which makes it a business associate under 45 CFR 160.103, not a covered entity itself.
• D: Wrong. A scheduling software vendor that accesses PHI to perform a function for a covered entity is a business associate, not a health plan, clearinghouse, or provider.

Correct answer: B. Business associate, because it creates, receives, maintains, or transmits PHI on the group's behalf

Correct. 45 CFR 160.103 defines a business associate as a person or entity that creates, receives, maintains, or transmits PHI to perform a function on behalf of a covered entity, requiring a business associate agreement.

• A: Wrong. Storing PHI does not itself make an entity a covered entity; covered-entity status turns on functioning as a health plan, clearinghouse, or provider, which this vendor does not do.
• C: Wrong. Hybrid entity status under 45 CFR 164.105 applies to a single legal entity that designates internal covered and non-covered components, not to a separate outside vendor.
• D: Wrong. Access to PHI on a covered entity's behalf brings the vendor squarely under HIPAA's business associate obligations regardless of whether it treats patients.

Correct answer: A. A written business associate agreement satisfying 45 CFR 164.504(e)

Correct. 45 CFR 164.504(e) requires a written business associate agreement establishing permitted uses, required safeguards, and breach reporting duties before PHI may be shared.

• B: Wrong. HIPAA does not require individual patient consent to engage a business associate for payment or health care operations functions; the BAA governs that relationship instead.
• C: Wrong. A vendor's informal assurance is not a substitute for the legally required written contract specified in the rule.
• D: Wrong. An oral understanding does not satisfy the Privacy Rule's requirement for a written, signed agreement with defined obligations.

Correct answer: B. A patient's name linked to a lab result held by a hospital

Correct. PHI is individually identifiable health information created or held by a covered entity, and a name tied to a lab result is both identifiable and health-related.

• A: Wrong. Aggregate statistics containing no individually identifiable information do not meet the definition of PHI at 45 CFR 160.103.
• C: Wrong. Properly de-identified data under 45 CFR 164.514 falls outside the definition of PHI because it can no longer identify an individual.
• D: Wrong. 45 CFR 160.103 expressly excludes employment records held by a covered entity in its role as employer from the definition of PHI.

Correct answer: A. Access should be limited to the specific information needed for the billing function

Correct. 45 CFR 164.502(b) requires covered entities to limit PHI use and disclosure to the minimum necessary to accomplish the intended purpose, here just the billing-relevant data elements.

• B: Wrong. Being an employee of the covered entity does not exempt a workforce member from the minimum necessary limitation on internal use.
• C: Wrong. Minimum necessary is an internal-use limitation, not an authorization trigger; routine billing under a health plan's payment function does not require patient authorization.
• D: Wrong. The minimum necessary standard applies specifically to internal workforce access and use of PHI, not just external disclosures.