HIPAA Compliance Quiz

A nurse accidentally leaves a patient's medical chart visible on a counter. What HIPAA violation has occurred?

• Breach of confidentiality

• Unauthorized access

• Data encryption failure

• Improper disposal of PHI

Which of the following is NOT considered Protected Health Information (PHI) under HIPAA?

• Patient's name and address

• Social Security number

• Medical record number

• Number of steps taken daily

A hospital employee discusses a celebrity patient's condition with a friend. This is an example of:

• Permitted disclosure

• Incidental disclosure

• Unauthorized disclosure

• Minimum necessary disclosure

What is the primary purpose of the HIPAA Privacy Rule?

• To ensure all medical records are digitized

• To protect patient health information

• To standardize medical coding

• To regulate health insurance costs

A medical office receives a request from a patient to view their medical records. How long does the office have to comply?

• 24 hours

• 72 hours

• 30 days

• 60 days

Which of the following is NOT a covered entity under HIPAA?

• Hospitals

• Health insurance companies

• Pharmacies

• Fitness tracking app companies

What is the recommended method for disposing of paper documents containing PHI?

• Shredding the documents

• Throwing them in the regular trash

• Burning them in an open area

• Recycling them without shredding

A doctor wants to send a patient's test results via email. What should be done to comply with HIPAA?

• Send as a password-protected attachment

• Include only the patient's initials

• Use a personal email account

• CC the patient's family members

What does the "Portability" in HIPAA primarily refer to?

• The ability to carry medical devices between facilities

• The ease of transferring electronic health records

• The continuation of health coverage when changing jobs

• The portability of health insurance across state lines

A receptionist overhears a conversation about a patient's condition and shares it on social media without naming the patient. This is:

• Acceptable if the patient isn't named

• A HIPAA violation

• Permitted under the First Amendment

• Only a violation if the patient finds out