Deck 4: Hipaa: Health Insurance Portability and Accountability Act of 1996

Question 1

Under the HIPAA Privacy Rule, a physician may discuss a patient's medical condition or treatment with a family member or friend only if:

A)it is necessary in discussing payment for services.
B)the patient is unconscious.
C)the patient agrees verbally, in writing, or consent is implied.
D)the patient has a terminal illness.

Answer 1

the patient agrees verbally, in writing, or consent is implied.

Question 2

The process of scrambling and encoding electronic data to prevent it from being read by unauthorized users is known as:

A)encryption.
B)coding.
C)translation.
D)transcription.

Answer 2

encryption.

Question 3

Providers are legally obligated to disclose protected health information (PHI) to public health authorities when a:

A)particularly severe flu epidemic has occurred.
B)person may have been exposed to certain communicable diseases.
C)patient or staff member has a prison record.
D)patient has returned from a trip to a country with poor sanitation.

Answer 3

person may have been exposed to certain communicable diseases.

Question 4

The document used to authorize permission for the release of protected health information (PHI) is the:

A)designation for release of medical information form.
B)designation of beneficiary form.
C)acknowledgment of informed consent form.
D)assignment of benefits form.

Question 5

HIPAA privacy protections apply to which type of healthcare data?

A)Paper and electronic records
B)Paper records only
C)Electronic records only
D)Paper and electronic records created in the last 5 years

Question 6

Each medical practice must appoint a person to serve as its Privacy Compliance Officer, who must be familiar with federal and state privacy regulations in order to:

A)file monthly reports with the office of the state insurance commissioner.
B)respond to insurance carriers' questions and handle patient billing complaints.
C)respond to requests for medical records and handle privacy-related issues and complaints.
D)represent the practice in any lawsuits that arise over privacy issues.

Question 7

A provider may share patient information with an interpreter when the interpreter is:

A)a friend of the patient and the patient agrees.
B)a family member of the patient and the patient agrees.
C)a staff member, contractor, or volunteer who works for the provider.
D)all of the above.

Question 8

Under HIPAA, which of the following are covered entities?

A)Health insurance plans
B)Healthcare providers
C)Clearinghouses
D)Most employers

Question 9

Under the HIPAA Privacy Rule, a patient's medical record and claims history are considered:

A)protected health information.
B)managed care plan information.
C)secure medical data.
D)electronically transmitted data.

Question 10

In the event of a security breach in regard to protected health information (PHI), providers and other covered entities must notify both the DHHS Office for Civil Rights (OCR) and the:

A)individuals whose records were affected.
B)Centers for Medicare and Medicaid Services (CMS).
C)insurance carriers whose claims were affected.
D)Consumer Protection Agency.

Question 11

The overall purpose of HIPAA transactions and code set rules is to:

A)require that all claims be submitted in exactly the same electronic format.
B)limit the number of methods that can be used for file encryption.
C)standardize the electronic exchange of protected health information (PHI).
D)authorize certain organizations to act as claims clearinghouses.

Question 12

The provision of HIPAA that applies to the use and disclosure of protected health information is the:

A)Administrative Rule.
B)Reimbursement Rule.
C)Privacy Rule.
D)Medical Records Rule.

Question 13

HIPAA guidelines grant patients the right to access their own medical records and the right to:

A)at least 10 free copies.
B)request corrections of any inaccuracies in the records.
C)designate a specific person at an insurance company who may also have access.
D)file a complaint about how long it takes to get a claim paid.

Question 14

If the patient is a minor, consent to the disclosure of protected health information (PHI) must be provided by a parent or:

A)grandparent.
B)legal guardian.
C)sibling.
D)teacher.

Question 15

The advantage of using electronic data interchange standards (EDI) in the transmission of medical and claims data is:

A)improved data quality.
B)faster processing of transactions.
C)lower operating costs.
D)all of the above.

Question 16

Protected health information (PHI) can be disclosed in which of the following circumstances?

A)A coroner requests it to assist in identifying a body.
B)The U.S. Food and Drug Administration requests it in relation to a product recall.
C)An organ procurement organization requests it to facilitate the donation and transplantation of organs.
D)A patient has been admitted to the emergency department and the family is trying to locate him or her.

Question 17

HIPAA guidelines apply to which of the following types of healthcare administrative transactions?

A)Health insurance claims
B)Claim status requests and reports
C)Eligibility requests and verifications
D)All of the above

Question 18

A person who has a privacy complaint can file it with the:

A)Food and Drug Administration (FDA).
B)Centers for Medicare and Medicaid Services (CMS).
C)DHHS Office for Civil Rights (OCR).
D)American Medical Association (AMA).

Question 19

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 1996, and covered entities were required to fully implement its guidelines by:

A)2000.
B)2002.
C)2003.
D)2005.

Question 20

Approximately how many different formats are currently being used for electronic health claims?

A)350
B)400
C)450
D)500

Question 21

Which of the following is a current HIPAA-approved code set?

A)ICD-9-CM or ICD-10-CM
B)NDC
C)HCPCS
D)All of the above

Question 22

Which type of safeguard involves having disaster recovery procedures in place to secure data in the event of a disaster or emergency?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 23

Which type of safeguard involves the use of encryption when data is transmitted over open networks?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 24

Which type of safeguard involves having procedures that clearly identify which employees have access to electronic protected health information (EPHI) and ongoing employee training on the proper methods for handling EPHI?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 25

Which type of safeguard involves limiting access to computer hardware and software only to properly authorized personnel?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 26

The unique identifier for insurance plans and third-party payers and administrators is the:

A)Federal Employer Identification Number (EIN).
B)Social Security number.
C)National Provider Identifier (NPI).
D)National Health Plan Identifier.

Question 27

The HIPAA Security Rule complements the Privacy Rule but applies exclusively to:

A)protected health information.
B)electronic protected health information.
C)medical claims.
D)hospital claims.

Question 28

The electronic record that includes documentation of patient care across multiple healthcare organizations that can be viewed by all providers who have a relationship with the patient is the electronic:

A)data interchange.
B)health record.
C)medical record.
D)patient database.

Question 29

Civil penalties for HIPAA violations can range between what dollar amounts per person per violation of a single standard per calendar year?

A)$100 to $25,000
B)$250 to $35,000
C)$500 to $25,000
D)$250 to $50,000

Question 30

The unique identifier for employers (business entities) that sponsor health insurance plans is the:

A)Federal Employer Identification Number (EIN).
B)Social Security number.
C)National Provider Identifier (NPI).
D)National Health Plan Identifier.

Question 31

All of the following are HIPAA-approved code sets EXCEPT:

A)NPI.
B)ICD-9-CM or ICD-10-CM.
C)NDC.
D)CPT.

Question 32

The electronic record that documents a patient's encounters with physicians and other clinicians that is stored within one provider's system is the electronic:

A)data interchange.
B)health record.
C)medical record.
D)patient database.

Question 33

Which type of safeguard involves establishing and maintaining authentication systems such as passwords, double keying, and token systems?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 34

The HIPAA Unique Identifiers Rule requires that standard formats be used to identify:

A)healthcare providers.
B)health insurance plans.
C)employers that sponsor health insurance plans.
D)all of the above.

Question 35

The unique identifier for physicians, nurses, and other healthcare professionals, organizations, and facilities that provide healthcare services or supplies is the:

A)Federal Employer Identification Number (EIN).
B)Social Security number.
C)National Provider Identifier (NPI).
D)National Health Plan Identifier.

Question 36

Criminal penalties for HIPAA violations can include fines and what type of prison sentences?

A)1 year to 5 years
B)1 year to 10 years
C)2 years to 8 years
D)2 years to 15 years

Question 37

Which provision of HIPAA deals with procedures for investigations and hearings related to compliance issues and penalties for violations?

A)Privacy Rule
B)Unique Identifiers Rule
C)Enforcement Rule
D)Security Rule

Question 38

HIPAA requires that diagnoses and services be reported in a standard, consistent manner; this is accomplished by using uniform:

A)claim forms.
B)code sets.
C)descriptors.
D)modifiers.

Question 39

Which type of safeguard involves controlling access to facility security plans and maintenance records and requiring all visitors to sign in?

A)Administrative
B)Procedural
C)Physical
D)Technical

Question 40

The three types of safeguards that must be in place to be in compliance with the HIPAA Security Rule are:

A)technical, training, and administrative.
B)physical, administrative, and technical.
C)administrative, physical, and electronic.
D)physical, technical, and procedural.

Question 41

The Health Insurance Portability and Accountability Act (HIPAA) was signed into law in 2003.

Question 42

HITECH Stage 1 requirements include the implementation of a computerized:

A)medical coding system.
B)medical practice management system.
C)provider order entry system.
D)accounting system.

Question 43

Healthcare providers who achieve the standards of each HITECH stage by a designated date are eligible for:

A)free license renewals as long as they remain in practice.
B)Medicare incentive payments.
C)Medicaid incentive payments.
D)Medicare and Medicaid incentive payments.

Question 44

A patient's electronic health record can contain information from multiple providers at multiple facilities such as physician offices, hospitals, imaging centers, and laboratories.

Question 45

The HITECH Act is part of the:

A)Health Insurance Portability and Accountability Act.
B)American Recovery and Reinvestment Act.
C)Tax Relief and Health Care Act.
D)Occupational Health and Safety Act.

Question 46

Criminal penalties for HIPAA violations can include prison time and financial penalties up to what maximum amount?

A)$100,000
B)$150,000
C)$250,000
D)$400,000

Question 47

Under HIPAA, medical schools are considered covered entities.

Question 48

The HITECH requirements for the implementation of standardized electronic health records and related technologies are known as:

A)standard code sets.
B)meaningful use.
C)certification.
D)computerized provider order entry.

Question 49

Protected health information (PHI) can be released to interpreters in situations when the patient has given consent.

Question 50

The HITECH Act introduced which concept in regard to electronic health information?

A)Hacking prevention
B)Authorized use
C)Fraud prevention
D)Meaningful use

Question 51

When patients ask a family member to remain with them in a treatment room, this implies that they have given permission for the doctor and/or staff to discuss their condition in front of the family member.

Question 52

The HIPAA Privacy rule forbids providers from ever disclosing protected health information (PHI) without the patient's permission, even in response to a court order.

Question 53

Which stage of HITECH requirements focuses on the use of electronic health records in disease management, clinical decision support, and quality measurement?

A)Stage 1
B)Stage 2
C)Stage 3
D)Stage 4

Question 54

Patients have the right to access and copy their medical records, but they cannot dispute anything in the record.

Question 55

Providers who do NOT achieve the HITECH meaningful use standards by 2015 and in subsequent years will face penalties that consist of:

A)reductions in the rate of Medicare reimbursement.
B)reductions in the rate of Medicaid reimbursement.
C)annual fines until they are in compliance.
D)all of the above.

Question 56

The majority of Medicare claims are submitted electronically.

Question 57

Providers may be asked to provide protected health information (PHI) as part of FDA investigations related to product defects or recalls.

Question 58

What does the work plan released by the Office of Inspector General each year focus on?

A)Inspections of healthcare facilities
B)New provisions added to the HIPAA rules
C)Enhancements to computer security systems
D)Areas targeted for fraud and abuse investigation

Question 59

ICD-10-CM will NOT be approved as a uniform code set according to HIPAA guidelines.

Question 60

The HITECH Act expands the privacy provisions of HIPAA to include:

A)corporate owners of covered entities.
B)business associates of covered entities.
C)friends and family of providers.
D)friends and family of patients.

Question 61

Compliance with the HITECH Act is to occur in three stages, and organizations can receive financial incentives for achieving compliance objectives by designated dates.

Question 62

The HIPAA Privacy Rule regulates the use and __________ of protected health information (PHI).

Question 63

The three types of protections of electronic data that must be in place to be in compliance with the HIPAA Security Rule are administrative, physical, and technical __________ .

Question 64

The Department of Health and Human Services agency that handles privacy complaints is the Office for __________ .

Question 65

Technical safeguards are rules and policies related to the documenting of time-consuming, complex medical procedures.

Question 66

Under HIPAA, any information related to patient identity, patient health status, the provision of care, or payment for services is considered __________ .

Question 67

The electronic transfer of information in a standardized format between trading partners is called __________ .

Question 68

The person in medical practice who handles requests for medical records and serves as the primary contact person in regard to HIPAA confidentiality issues is the __________ Officer.

Question 69

Data that has been scrambled and/or encoded to prevent it from being readable by unauthorized users is __________ .

Question 70

Under HIPAA, health plans, providers, and clearinghouses are considered __________ .

Question 71

Civil penalties are penalties that include prison time.

Question 72

Each individual health plan must use a unique National Provider Identifier.

Question 73

Pharmacies and __________ equipment (DME) companies can be more flexible than providers' offices in their requirements for authorizations for the release of information.

Question 74

The HITECH Act is a subset of the original HIPAA legislation.

Question 75

Goals of the HITECH Act include fraud prevention and enhancing data security.

Question 76

Physical safeguards are measures put in place to control or limit physical access to protected data.

Question 77

Electronic documentation of patient care that can include multiple providers, services, and facilities is referred to as an electronic __________ .

Question 78

Administrative safeguards are policies and procedures that demonstrate how a covered entity will comply with HIPAA rules.

Question 79

Technical safeguards include data corroboration, authentication, and data security measures.

Question 80

Privacy Compliance Officers should focus their annual training efforts on areas targeted by the OIG for fraud and abuse investigation.