Free Utah HIPAA Practice Test Online

Correct answer: A. A covered entity (health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a covered transaction) or its business associate

Correct. Under 45 CFR 160.103, PHI is individually identifiable health information transmitted or maintained by a covered entity (a health plan, health care clearinghouse, or health care provider that conducts certain transactions electronically) or by a business associate acting on the covered entity's behalf.

• B: Physician offices, clinics, pharmacies, dental practices, and other qualifying health care providers are covered entities too, not just hospitals.
• C: HIPAA applies to private-sector and state-level covered entities and business associates, not exclusively to the federal government.
• D: HIPAA's PHI definition is specific to health information handled by covered entities and business associates, not a general rule covering any business that stores personal data.

Correct answer: C. A patient's name linked to their diagnosis and treatment date in a medical record

Correct. PHI is individually identifiable health information, so a patient's name connected to diagnosis and treatment details is a textbook example covered by the HIPAA Privacy Rule.

• A: Ordinary employment and payroll records held by an employer in its role as employer are generally not PHI, since HIPAA regulates health information handled by covered entities in their health care capacity, not standard HR/payroll functions.
• B: A general marketing list containing no health information does not meet the definition of individually identifiable health information.
• D: Properly de-identified information, stripped of the 18 identifiers specified under the Safe Harbor method (or verified through expert determination), is no longer PHI and falls outside HIPAA's protections.

Correct answer: C. Access, use, or disclose only the amount of PHI reasonably necessary to accomplish the intended purpose

Correct. The minimum necessary standard under 45 CFR 164.502(b) and 164.514(d) requires covered entities and their workforce to limit PHI access, use, and disclosure to the minimum amount reasonably necessary to accomplish the intended purpose.

• A: PHI must not be shared based on a coworker's mere request; minimum necessary requires assessing whether access is actually needed for that person's role and the specific purpose.
• B: Accessing an entire record when only specific information is needed violates the minimum necessary principle, which limits access to what the task actually requires.
• D: Avoiding all PHI access is not the standard; workforce members are expected to access the specific PHI they need to do their job, just not more than that.

Correct answer: B. Disclosures for treatment purposes between health care providers

Correct. Under 45 CFR 164.502(b)(2), disclosures to (and requests by) a health care provider for treatment purposes are excluded from the minimum necessary standard, because clinical judgment about what information is needed for patient care should not be second-guessed by a fixed rule.

• A: Routine administrative and business associate disclosures, such as to a billing vendor, remain subject to the minimum necessary standard.
• C: Disclosures made to a health plan for payment purposes are still subject to the minimum necessary standard; the treatment exception does not extend to payment activities.
• D: Marketing disclosures are subject to minimum necessary and, in most cases, require the individual's separate authorization altogether; they are not exempt.

Correct answer: B. Treatment, payment, and health care operations (TPO)

Correct. 45 CFR 164.506 permits a covered entity to use or disclose PHI for its own treatment, payment, and health care operations, and for certain treatment-related disclosures to other providers, without needing the individual's written authorization.

• A: Selling PHI generally requires the individual's specific, signed authorization under HIPAA's sale-of-PHI provisions; it is not a TPO activity exempt from authorization.
• C: Disclosing PHI to an employer for employment decisions generally requires specific authorization from the individual, since this is not a treatment, payment, or health care operations purpose.
• D: Publicly posting PHI, such as on social media, is not a permitted TPO use or disclosure and would require authorization (and is rarely, if ever, appropriate).