Question 1

Security reminders, using an anti-virus program on workstations, keeping track of when users log-in and out, and password management are all part of:

Accepted Answer

A)  Security incident Procedures 
B)  information Access Management 
C)  Security Awareness and Training 
D)  Workforce Security 
E)  Security Management Process 
A)  Security incident Procedures 
B)  information Access Management 
C)  Security Awareness and Training 
D)  Workforce Security 
E)  Security Management Process

Question 2

An Electronic Medical Record (EMR):

Accepted Answer

A)  Is another name for the Security Ruling. 
B)  Requires the use of biometrics for access to records. 
C)  Is electronically stored information about an individual's health status and health care. 
D)  Identifies all hospitals and health care organizations. 
E)  Requires a PK1 for the provider and the patient. 
A)  Is another name for the Security Ruling. 
B)  Requires the use of biometrics for access to records. 
C)  Is electronically stored information about an individual's health status and health care. 
D)  Identifies all hospitals and health care organizations. 
E)  Requires a PK1 for the provider and the patient.

Question 3

This transaction is typically used in two modes: update and full replacement:

Accepted Answer

A)  Premium Payment. 
B)  Health Care Claim. 
C)  First Report of Injury. 
D)  Health Plan Enrollment and Dis-enrollment. 
E)  Coordination of Benefits. 
A)  Premium Payment. 
B)  Health Care Claim. 
C)  First Report of Injury. 
D)  Health Plan Enrollment and Dis-enrollment. 
E)  Coordination of Benefits.

Question 4

An Electronic Medical Record (EMR):

Accepted Answer

A)  Is another name for the Security Ruling. 
B)  Requires the use of biometrics for access to records. 
C)  Is electronically stored information about an individual's health status and health care. 
D)  Identifies all hospitals and health care organizations. 
E)  Requires a P1<1 for the provider and the patient. 
A)  Is another name for the Security Ruling. 
B)  Requires the use of biometrics for access to records. 
C)  Is electronically stored information about an individual's health status and health care. 
D)  Identifies all hospitals and health care organizations. 
E)  Requires a P1<1 for the provider and the patient.

Question 5

This security standard requires that the covered entity establishes agreements with each organization with which it exchanges data electronically, protecting the security of all such data:

Accepted Answer

A)  Security incident Procedures 
B)  Integrity 
C)  Person or Entity Authentication 
D)  Assigned Security Responsibility 
E)  Business Associate Contracts and other Arrangements 
A)  Security incident Procedures 
B)  Integrity 
C)  Person or Entity Authentication 
D)  Assigned Security Responsibility 
E)  Business Associate Contracts and other Arrangements

Question 6

A pharmacist is approached by an individual and asked a question about an over-the-counter medication. The pharmacist needs some protected health information (PHI) from the individual to response the question. The pharmacist will not be creating a record of this interaction. The Privacy Rule requires the pharmacist to:

Accepted Answer

A)  Verbally request a consent and offer a copy of the Notice of Privacy Practices. 
B)  Verbally request specific authorization for the PHI. 
C)  Do nothing more. 
D)  Obtain the signature of the patient on their Notice of Privacy Practices. 
E)  Not respond to the request without an authorization from the primary physician. 
A)  Verbally request a consent and offer a copy of the Notice of Privacy Practices. 
B)  Verbally request specific authorization for the PHI. 
C)  Do nothing more. 
D)  Obtain the signature of the patient on their Notice of Privacy Practices. 
E)  Not respond to the request without an authorization from the primary physician.

Question 7

HIPAA establishes a civil monetary penalty for violation of the Administrative Simplification provisions. The penalty may not be more than:

Accepted Answer

A)  $1 000000 per person per violation of a single standard for a calendar year 
B)  $10 per person per violation of a single standard for a calendar year. 
C)  $25000 per person per violation of a single standard for a calendar year. 
D)  $2,500 per person per violation of a single standard for a calendar year. 
E)  $1000 per person per violation of a single standard for a calendar year. 
A)  $1 000000 per person per violation of a single standard for a calendar year 
B)  $10 per person per violation of a single standard for a calendar year. 
C)  $25000 per person per violation of a single standard for a calendar year. 
D)  $2,500 per person per violation of a single standard for a calendar year. 
E)  $1000 per person per violation of a single standard for a calendar year.

Question 8

Select the best statement regarding the definition of protected health information (PHI).

Accepted Answer

A)  PHI includes all individually identifiable health information (IIHI). 
B)  PHI does not include physician's hand written notes about the patient's treatment. 
C)  PHI does not include PHI stored on paper. 
D)  PHI does not include PHI in transit. 
E)  PHI includes de-identified health information. 
A)  PHI includes all individually identifiable health information (IIHI). 
B)  PHI does not include physician's hand written notes about the patient's treatment. 
C)  PHI does not include PHI stored on paper. 
D)  PHI does not include PHI in transit. 
E)  PHI includes de-identified health information.

Question 9

Some of the information that an authorization must include is:

Accepted Answer

A)  The date on which any automatic extension occurs. 
B)  Covered entity's signature. 
C)  A statement that federal privacy laws still protect the information after it is disclosed. 
D)  A statement that the individual has no right to revoke the authorization. 
E)  The date signed. 
A)  The date on which any automatic extension occurs. 
B)  Covered entity's signature. 
C)  A statement that federal privacy laws still protect the information after it is disclosed. 
D)  A statement that the individual has no right to revoke the authorization. 
E)  The date signed.

Question 10

This is a documented and routinely updated plan to create and maintain, for a specific period of time, retrievable copies of information:

Accepted Answer

A)  Disaster Recovery Plan 
B)  Data Backup Plan 
C)  Facility Access Controls 
D)  Security Incident Procedures 
E)  Emergency Mode Operations Plan 
A)  Disaster Recovery Plan 
B)  Data Backup Plan 
C)  Facility Access Controls 
D)  Security Incident Procedures 
E)  Emergency Mode Operations Plan

Question 11

Health information is protected by the Privacy Rule as long as:

Accepted Answer

A)  The authorization has been revoked by the physician 
B)  The patient remains a citizen of the United States 
C)  The information is under the control of HHS 
D)  The information is in the possession of a covered entity 
E)  The information is not also available on paper forms 
A)  The authorization has been revoked by the physician 
B)  The patient remains a citizen of the United States 
C)  The information is under the control of HHS 
D)  The information is in the possession of a covered entity 
E)  The information is not also available on paper forms

Question 12

The transaction number assigned to the Payment Order/Remittance Advice transaction is:

Accepted Answer

A)  270 
B)  836 
C)  278 
D)  820 
E)  834 
A)  270 
B)  836 
C)  278 
D)  820 
E)  834

Question 13

A covered entity' that fails to implement the HIPAA Privacy Rule would risk:

Accepted Answer

A)  $50O0 in fines. 
B)  $5000 in fines and six months in prison. 
C)  An annual cap of $5000 in fines. 
D)  A fine of up to $50000 if they wrongfully disclose PHI. 
E)  Six months in prison. 
A)  $50O0 in fines. 
B)  $5000 in fines and six months in prison. 
C)  An annual cap of $5000 in fines. 
D)  A fine of up to $50000 if they wrongfully disclose PHI. 
E)  Six months in prison.

Question 14

The Data Backup Plan is part of which Security Standard?

Accepted Answer

A)  Contingency Plan 
B)  Evaluation 
C)  Security Management Procedures 
D)  Facility Access Control 
E)  Security Incident Procedures 
A)  Contingency Plan 
B)  Evaluation 
C)  Security Management Procedures 
D)  Facility Access Control 
E)  Security Incident Procedures

Question 15

Select the correct statement regarding the Notice of Privacy Practices.

Accepted Answer

A)  The Notice must be signed before a State authorized notary. 
B)  Direct Treatment Providers must make a good faith effort to obtain patient's written acknowledgement of Notice of Privacy Practices. 
C)  Organizations may not have a "layered" Notice - a short, summary Notice preceding the more detailed Notice. 
D)  Authorization forms are mandatory for the Notice to be valid. 
E)  An individual must sign an authorization before a state authorized notary. 
A)  The Notice must be signed before a State authorized notary. 
B)  Direct Treatment Providers must make a good faith effort to obtain patient's written acknowledgement of Notice of Privacy Practices. 
C)  Organizations may not have a "layered" Notice - a short, summary Notice preceding the more detailed Notice. 
D)  Authorization forms are mandatory for the Notice to be valid. 
E)  An individual must sign an authorization before a state authorized notary.

Question 16

Individually identifiable health information (IIHI) includes information that is:

Accepted Answer

A)  Transmitted to a business associate for payment purposes only. 
B)  Stored on a smart card only by the patient. 
C)  Created or received by a credit company that provided a personal loan for surgical procedures. 
D)  Created or received by a health care clearinghouse for claim processing. 
E)  Requires the use of biometrics for access to records. 
A)  Transmitted to a business associate for payment purposes only. 
B)  Stored on a smart card only by the patient. 
C)  Created or received by a credit company that provided a personal loan for surgical procedures. 
D)  Created or received by a health care clearinghouse for claim processing. 
E)  Requires the use of biometrics for access to records.

Question 17

Which HIPAA Title is fueling initiatives within organizations to address health care priorities in the areas of transactions, privacy, and security'?

Accepted Answer

A)  Title I 
B)  Title II 
C)  Title Ill 
D)  Title W 
E)  Title V 
A)  Title I 
B)  Title II 
C)  Title Ill 
D)  Title W 
E)  Title V

Question 18

Title 1 of the HIPAA legislation in the United States is about:

Accepted Answer

A)  P1<1 requirements for hospitals and health care providers. 
B)  Encryption algorithms that must be supported by hospitals and health care providers. 
C)  Fraud and abuse in the health care system and ways to eliminate the same. 
D)  Guaranteed health insurance coverage to workers and their families when they change employers. 
E)  The use of strong authentication technology that must be supported by hospitals and health care providers. 
A)  P1<1 requirements for hospitals and health care providers. 
B)  Encryption algorithms that must be supported by hospitals and health care providers. 
C)  Fraud and abuse in the health care system and ways to eliminate the same. 
D)  Guaranteed health insurance coverage to workers and their families when they change employers. 
E)  The use of strong authentication technology that must be supported by hospitals and health care providers.

Question 19

Select the best example of a business associate (if they had access to PHI).

Accepted Answer

A)  Accountants 
B)  Hospital employees 
C)  A covered entity's internal IT department 
D)  CEO of the covered entity 
E)  The covered entity's billing service department 
A)  Accountants 
B)  Hospital employees 
C)  A covered entity's internal IT department 
D)  CEO of the covered entity 
E)  The covered entity's billing service department

Question 20

Signed authorization forms must be retained:

Accepted Answer

A)  Indefinitely, because the life of a signed authorization is indefinite 
B)  Six (6) years from the time it expires. 
C)  For as long as the patient's records are kept. 
D)  Until it is specifically revoked by the individual. 
E)  Ten (10) years from the date it was signed. 
A)  Indefinitely, because the life of a signed authorization is indefinite 
B)  Six (6) years from the time it expires. 
C)  For as long as the patient's records are kept. 
D)  Until it is specifically revoked by the individual. 
E)  Ten (10) years from the date it was signed.

Exam 1: Certified HIPAA Professional (CHP)

Security reminders, using an anti-virus program on workstations, keeping track of when users log-in and out, and password management are all part of:

An Electronic Medical Record (EMR):

This transaction is typically used in two modes: update and full replacement:

An Electronic Medical Record (EMR):

This security standard requires that the covered entity establishes agreements with each organization with which it exchanges data electronically, protecting the security of all such data:

HIPAA establishes a civil monetary penalty for violation of the Administrative Simplification provisions. The penalty may not be more than:

Select the best statement regarding the definition of protected health information (PHI).

Some of the information that an authorization must include is:

This is a documented and routinely updated plan to create and maintain, for a specific period of time, retrievable copies of information:

Health information is protected by the Privacy Rule as long as:

The transaction number assigned to the Payment Order/Remittance Advice transaction is:

A covered entity' that fails to implement the HIPAA Privacy Rule would risk:

The Data Backup Plan is part of which Security Standard?

Select the correct statement regarding the Notice of Privacy Practices.

Individually identifiable health information (IIHI) includes information that is:

Which HIPAA Title is fueling initiatives within organizations to address health care priorities in the areas of transactions, privacy, and security'?

Title 1 of the HIPAA legislation in the United States is about:

Select the best example of a business associate (if they had access to PHI).

Signed authorization forms must be retained:

Filters