For PHI disclosures in which there is personal gain, or for malicious purposes, federal penalties can include up to ___ year(s) in prison.

• 5

• 1

• 10

• 15

A healthcare employee's access to PHI is usually determined by their:

• Education

• Job duties in the healthcare organization

• Length of employment

HIPAA is a federal law which is enforced by:

• OIG - Office of the Inspector General

• COC - Centers for Disease Control

• OCR - Office for Civil Rights of the Department of Health and Human Services

• CMS - Centers for Medicare and Medicaid Services

PHI can be recorded on paper or verbally. The electronic documentation of PHI is not covered under the HIPAA rules.

• True

• False

If a patient requests copies of their PHI, the covered entity may impose a fee for labor, photocopying, supplies and postage.

• True

• False

Under HIPAA, as part of a patient's right to restrict their PHI, a patient can request that they not be listed in the patient directory.

• True

• False

Under the HIPAA Omnibus Rule, patients can ask for and receive copies of their medical records in an electronic form.

• True

• False

Prior to a student entering into a "clinical rotation" at a hospital, HIPAA training must be provided to the student.

• True

• False

A covered entity must act upon a request for access to PHI no later than ___ days after receipt of the request, under normal circumstances.

• 15

• 14

• 45

• 30

__________________ is defined as an impermissible disclosure of PHI that compromises the security or privacy of the patient.

• Data dictionary

• Disclosure

• Breach

• Notice of Privacy Practice