The HIPAA Security Rule requires covered entities to: (Select all that apply.)⁴

• maintain reasonable and appropriate administrative, technical, and physical safeguards for protecting electronic protected health information (e-PHI).

• Ensure the confidentiality, integrity, and availability of all e-PHI they create, receive, maintain or transmit.

• Identify and protect against reasonably anticipated threats to the security or integrity of the information.

• Protect against reasonably anticipated, impermissible uses or disclosures.

• Ensure compliance by their workforce.

A covered entity must designate a ___________________ who is responsible for developing and implementing its security policies and procedures.⁴

• physician

• security official

• police officer

• custodian

The HIPAA Security Rule requires a covered entity to implement policies and procedures for authorizing access to e-PHI only when such access is appropriate based on the user or recipient's role (role-based access).⁴

• True

• False

A covered entity may disclose protected health information (PHI) without a patient's written permission for:¹

• Treatment purposes

• Payment

• Health care operations activities

• All of the above

A covered entity must obtain the patient's written authorization for any use or disclosure of protected health information (PHI) in which circumstances? (Select all that apply.)¹

• Marketing activities

• Research

• PHI sales and licensing

• Information sharing needed for treatment

The Privacy Rule does not restrict the use or disclosure of ____________________________, which neither identifies nor provides a reasonable basis to identify an individual.¹

• non-protected health information (non-PHI)

• reverse PHI

• regulated PHI

• de-identified health information

Protected health information (PHI) is considered de-identified by HIPAA Privacy Rule standards by: (Select all that apply.)¹

• absence of actual knowledge by the covered entity that the remaining information could be used alone or in combination with other information to identify the individual

• removal of only patient name and date of birth

• a formal determination by a qualified expert

• the removal of 18 specified individual identifiers

The HIPAA Privacy Rule covers: (Select all that apply.)⁴

• Health plans

• Health care clearinghouses

• Health care providers who conduct certain financial and administrative transactions electronically.

• Life insurance companies

Examples of proper disposal methods of protected health information (PHI) may include: (Select all that apply.)⁴

• tossing into the trashcan or recycle bin.

• clearing (using software or hardware products to overwrite media with non-sensitive data).

• purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains).

• destroying (disintegration, pulverization, melting, incinerating, or shredding).

The Privacy Rule generally requires covered entities to take reasonable steps to limit uses, disclosures, or requests (if the request is to another covered entity) of protected health information (PHI) to the minimum necessary to accomplish the intended purpose, known as the minimum necessary standard.²

• True

• False