Free South Carolina HIPAA Practice Test Online

Correct answer: A. A health plan that processes and pays claims for its members

Correct. 45 CFR 160.103 defines covered entities as health plans, health care clearinghouses, and providers who transmit health information electronically in connection with a covered transaction.

• B: Wrong. A law firm is not one of the three covered entity categories; if it handles PHI on a covered entity's behalf it would instead be a business associate.
• C: Wrong. A janitorial vendor is not a health plan, clearinghouse, or provider, and typically does not access PHI in the course of its work, so it is neither a covered entity nor ordinarily a business associate.
• D: Wrong. A courier transporting specimens on behalf of a provider performs a function involving PHI on the provider's behalf, which makes it a business associate, not a covered entity.

Correct answer: B. A business associate, because it creates, receives, maintains, or transmits PHI to perform a function on the practice's behalf

Correct. 45 CFR 160.103 defines a business associate as a person or entity that creates, receives, maintains, or transmits PHI to perform a function or activity on behalf of a covered entity, such as billing.

• A: Wrong. The billing company does not itself provide treatment, adjudicate claims as a health plan, or act as a clearinghouse; it works on behalf of the practice, which is the hallmark of a business associate.
• C: Wrong. Handling PHI on a covered entity's behalf brings the company squarely within HIPAA's business associate requirements, including the need for a business associate agreement.
• D: Wrong. Hybrid entity status applies to a single legal entity that designates some of its own components as covered functions, not to a separate outside vendor.

Correct answer: B. A signed business associate agreement meeting the requirements of 45 CFR 164.504(e)

Correct. 45 CFR 164.504(e) requires a written business associate agreement establishing permitted uses of PHI, safeguard obligations, and breach reporting duties before access is granted.

• A: Wrong. Reputation does not substitute for the written contractual protections HIPAA requires before PHI is shared with a business associate.
• C: Wrong. Routine transcription in support of treatment and operations does not require individual patient authorization; the BAA is the governing mechanism.
• D: Wrong. A verbal promise does not satisfy the Privacy Rule's requirement for a documented, legally binding agreement.

Correct answer: B. Only the insurance and demographic information needed to confirm eligibility

Correct. 45 CFR 164.502(b) requires covered entities to limit PHI access to the minimum necessary to accomplish the intended purpose, here confirming insurance eligibility.

• A: Wrong. Pulling the full chart for an eligibility check, especially psychotherapy notes, exceeds what is needed and violates 45 CFR 164.502(b).
• C: Wrong. Prior clinical visit notes unrelated to eligibility verification are not minimally necessary for this billing task.
• D: Wrong. Accessing unrelated household members' records is unnecessary for verifying one patient's eligibility.

Correct answer: A. A disclosure to a consulting specialist for treatment purposes

Correct. 45 CFR 164.502(b)(2) exempts disclosures to health care providers for treatment purposes, since treating clinicians need full clinical context.

• B: Wrong. Fundraising communications are not treatment, payment, or operations disclosures to the individual, so minimum necessary still applies and additional fundraising rules govern opt-out rights.
• C: Wrong. Internal compliance reviews remain subject to minimum necessary; access should be limited to what the audit actually requires.
• D: Wrong. Research access is not automatically exempt; it generally requires a minimum necessary determination, IRB or Privacy Board waiver, authorization, or a data use agreement.