Free Wisconsin HIPAA Practice Test Online

Correct answer: B. Individually identifiable health information transmitted or maintained by a covered entity or business associate in any form or medium

Correct. 45 CFR 160.103 defines PHI as individually identifiable health information that is transmitted or maintained in any form or medium (electronic, paper, or oral) by a covered entity or its business associate.

• A: Incorrect because PHI is limited to information held by covered entities and business associates, not any holder of health information (e.g., a friend or employer generally is not bound by HIPAA).
• C: Incorrect because PHI is not limited to electronic records; paper records and oral communications containing identifiable health information are also PHI.
• D: Incorrect because de-identified information that meets the Safe Harbor or Expert Determination standard is, by definition, no longer PHI and falls outside the Privacy Rule's protections.

Correct answer: B. Business associate

Correct. A business associate is a person or entity that performs functions or activities on behalf of, or provides services to, a covered entity that involve access to PHI, such as claims processing; a Business Associate Agreement (BAA) is required.

• A: Incorrect. Covered entities are health plans, health care clearinghouses, and health care providers who transmit health information electronically in connection with a covered transaction; a billing vendor performing services on behalf of a provider is not itself the provider.
• C: Incorrect. A hybrid entity is a single legal entity that is a covered entity but performs both covered and non-covered functions internally, which does not describe an external billing vendor.
• D: Incorrect. HIPAA does not exempt billing/claims-processing vendors; since 2009 (HITECH Act), business associates are directly subject to many HIPAA Security Rule and Privacy Rule requirements.

Correct answer: A. The minimum necessary standard, which requires limiting PHI use, disclosure, and requests to the minimum needed to accomplish the intended purpose

Correct. The minimum necessary standard (45 CFR 164.502(b) and 164.514(d)) requires covered entities to limit workforce access, use, and disclosure of PHI to the minimum necessary to accomplish the intended purpose; role-based access controls implement this for staff like scheduling clerks.

• B: Incorrect. The right of access under 164.524 concerns a patient's own ability to obtain their records, not internal workforce access limits.
• C: Incorrect. The Notice of Privacy Practices informs patients how their information may be used, and is unrelated to limiting an employee's internal system access.
• D: Incorrect. Accounting of disclosures under 164.528 tracks certain external disclosures made by the entity, not internal minimum necessary access controls.

Correct answer: B. Treatment, payment, and health care operations (TPO)

Correct. 45 CFR 164.506 permits a covered entity to use and disclose PHI for its own treatment, payment, and health care operations without patient authorization, subject to minimum necessary where applicable.

• A: Incorrect. Selling PHI generally requires specific patient authorization under the HITECH Act's sale-of-PHI provisions (45 CFR 164.508(a)(4)); it is not a permitted use without authorization.
• C: Incorrect. Psychotherapy notes receive heightened protection under 164.508(a)(2) and require specific written authorization for nearly all disclosures, including to insurers, with very narrow exceptions.
• D: Incorrect. Disclosure to an employer for general employment decisions is not a permitted TPO disclosure and generally requires the individual's written authorization unless a specific regulatory exception applies.

Correct answer: C. Security awareness and training program for all workforce members

Correct. 45 CFR 164.308(a)(5) requires a security awareness and training program (including periodic security reminders) as an administrative safeguard for all members of the workforce.

• A: Incorrect. Encryption during transmission is a technical safeguard under 164.312(e), not an administrative safeguard.
• B: Incorrect. Physical access controls like badge readers are physical safeguards under 164.310(a), not administrative safeguards.
• D: Incorrect. Automatic logoff is a technical safeguard addressable specification under 164.312(a)(2)(iii), not an administrative safeguard.