Free Tennessee HIPAA Practice Test Online

Correct answer: D. Any health information in any form that identifies an individual or could reasonably identify an individual, including electronic, paper, and oral information

Correct. PHI encompasses health information in any form (electronic, paper, oral) that identifies or could identify an individual, maintained by covered entities.

• A: Incorrect. PHI is not limited to electronic records only; it includes paper and oral information in any form.
• B: Incorrect. Encryption does not remove information from PHI status; it is only a security safeguard. Encrypted data is still PHI.
• C: Incorrect. PHI includes current and historical records regardless of age; there is no age-based exclusion for health information.

Correct answer: D. A health care provider that transmits health information electronically in connection with standard transactions, a health plan, or a health care clearinghouse

Correct. Covered entities are health care providers (if they transmit electronically), health plans, and health care clearinghouses, as defined in 45 CFR 164.501.

• A: Incorrect. General businesses collecting employee health insurance information are not automatically covered entities under HIPAA unless they meet the specific definitions of providers, plans, or clearinghouses.
• B: Incorrect. Vendors and contractors are business associates, not covered entities. Business associates have different obligations under HIPAA.
• C: Incorrect. Government agencies maintaining public health records are not covered entities under HIPAA's Privacy Rule, unless they also serve as health plans or covered providers.

Correct answer: D. Conducting peer review activities to improve the quality of care provided by the hospital

Correct. Peer review, quality improvement, and case management are legitimate health care operations that do not require authorization under 45 CFR 164.506.

• A: Incorrect. Selling patient information for marketing purposes requires valid written authorization; this is not a permitted health care operation.
• B: Incorrect. Disclosing psychiatric information to an employer is not a permitted use for operations and would require patient authorization.
• C: Incorrect. Sharing medical history with external law firms for malpractice investigation requires authorization unless mandated by law.

Correct answer: B. A specific description of the information to be disclosed, the recipient, the purpose of the disclosure, and the patient's or legal representative's signature

Correct. Valid authorization under 45 CFR 164.508 must include specific descriptions of information, recipient, purpose, and patient signature, along with mandatory notice statements.

• A: Incorrect. Listing all staff members with access is not a required element of a valid authorization under HIPAA.
• C: Incorrect. Verbal agreement alone is insufficient; HIPAA requires written authorization with specific documented elements.
• D: Incorrect. Covered entities do not make clinical determinations regarding what is in the patient's best interest for authorization purposes.

Correct answer: B. Revocation is effective for all future disclosures, but does not invalidate uses or disclosures made before the revocation was received by the covered entity

Correct. HIPAA permits revocation of authorization prospectively, but the revocation does not affect uses or disclosures made before the covered entity received it, per 45 CFR 164.508(b).

• A: Incorrect. Covered entities cannot unilaterally revoke a patient's right to revoke authorization; this right belongs solely to the patient.
• C: Incorrect. Revocation does not retroactively invalidate prior disclosures that were lawfully made under a valid authorization.
• D: Incorrect. HIPAA does not require patients to provide a reason for revocation; it must be accepted without conditional requirements.