Question 1

This security rule standard requires policies and procedures for authorizing access to electronic protected health information that are consistent with its required implementation specifications- which are Isolating Health Care Clearinghouse Function, Access Authorization, and Access Establishment and Modification

Accepted Answer

A)  Access Control 
B)  Security Incident Procedures 
C)  information Access Management 
D)  Workforce Security 
E)  Security Management Process

Question 2

Select the best statement regarding the definition of the term "use" as used by the HIPAA regulations.

Accepted Answer

A)  'Use" refers to the release, transfer, or divulging of IIHI between various covered entities. 
B)  "Use" refers to adding, modifying and deleting the PHI by other covered entities. 
C)  "Use" refers to utilizing, examining, or analyzing IIHI within the covered entity 
D)  "Use" refers to the movement of de-identified information within an organization. 
E)  "Use" refers to the movement of information outside the entity holding the information.

Question 3

Select the best statement regarding de-identified information (DII).

Accepted Answer

A)  De-identified information is IIHI that has had all individually (patient) identifiable information removed. 
B)  DII may be used only with the authorization of the individual. 
C)  DII remains PHI. 
D)  The only approved method of de-identification is to have a person with "appropriate knowledge and experience" tie-identify the IIHI. 
E)  All PHI use and disclosure requirements do not apply to re-identified DII.

Question 4

Select the correct statement regarding code sets and identifiers.

Accepted Answer

A)  A covered entity must use the applicable code set that is valid at the time the transaction is initiated. 
B)  April 14, 2003 is the compliance date for implementation of the National Provider Identifier. 
C)  CMS is responsible for updating the CPT-4 code sets. 
D)  An organization that assigns NPIs is referred to as National Provider for Identifiers. 
E)  HHS assigns the Employer Identification Number (EIN), which has been selected as the National Provider Identifier for Health Care.

Question 5

The objective of this document is to safeguard the premises and building from unauthorized physical access and to safeguard the equipment therein from unauthorized physical access, tampering and theft:

Accepted Answer

A)  Contingency Plan 
B)  Facility Security Plan 
C)  Emergency Mode Operation Plan 
D)  Accountability 
E)  Device and Media Controls

Question 6

To comply with the Final Privacy Rule, a valid Notice of Privacy Practices:

Accepted Answer

A)  Is required for all Business Associate Contracts 
B)  Must always be associated with a valid authorization 
C)  Must be signed before providing treatment to a patient. 
D)  Must be associated with a valid Business Associate Contract 
E)  Must describe the individual's rights under the Privacy Rule.

Question 7

A hospital is preparing a file of treatment information for the state of California. This file is to be sent to external medical researchers. The hospital has removed SSN, name, phone and other information that specifically identifies an individual. However, there may still be data in the file that potentially could identify the individual. Can the hospital claim 'safe harbor" and release the file to the researchers?

Accepted Answer

A)  Yes the hospital's actions satisfy the "safe harbor" method of de-identification. 
B)  No - a person with appropriate knowledge and experience must determine that the information that remains can identify an individual. 
C)  No - authorization to release the information is still required by HIPAA. 
D)  No - to satisfy "safe harbor the hospital must also have no knowledge of a way to use the remaining data to identify an individual. 
E)  Yes - medical researchers are covered entities and "research" is considered a part of "treatment" by HIPAA.

Question 8

Use or disclosure of Protected Health Information (PHI) for Treatment, Payment, and Health care Operations (TPO) is:

Accepted Answer

A)  Limited to the minimum necessary to accomplish the intended purpose. 
B)  Left to the professional judgment and discretion of the requestor. 
C)  Controlled totally by the requestor's pre-existing authorization document. 
D)  Governed by industry "best practices" regarding use. 
E)  Left in force for eighteen (18) years.

Question 9

The National Provider Identifier (NPI) will eventually replace the:

Accepted Answer

A)  NPF 
B)  NPS 
C)  CDT 
D)  ICD-9-CM, Volume 3 
E)  UPIN

Question 10

The objective of this HIPAA security standard is to implement policies and procedures to prevent, detect, contain, and correct security Violations.

Accepted Answer

A)  Security Incident Procedures 
B)  Assigned Security Responsibility 
C)  Security Management Process 
D)  Access Control 
E)  Facility Access Control

Question 11

When submitting a Health Care Claim Status Request, it is important to provide the proper tracking information to exactly identify the previously submitted claim Select the information that would be most important to the claim inquiry/ process.

Accepted Answer

A)  Authorization Number 
B)  Provider's National Provider identifier (NPI) 
C)  Claim Submitter home phone number 
D)  Patient's lab report 
E)  Provider's security PIN code

Question 12

The implementation specifications for this HIPAA security standard (within Technical Safeguards) must support emergency access and unique user identification.

Accepted Answer

A)  Audit Control 
B)  integrity 
C)  Access Control 
D)  Person or Entity Authentication 
E)  Transmission Security

Question 13

This code set describes drugs:

Accepted Answer

A)  ICD-9-CM, Volumes 1 and 2 
B)  CPT-4 
C)  CDT 
D)  ICD-9-CM, Volume 3 
E)  NDC

Question 14

The Security Rule requires that the covered entity identifies a security official who is responsible for the development and implementation of the policies and procedures. This is addressed under which security standard?

Accepted Answer

A)  Security incident Procedures 
B)  Response and Reporting 
C)  Assigned Security Responsibility 
D)  Termination Procedures 
E)  Facility Access Controls

Question 15

Which of the following is example of "Payment" as defined in the HIPAA regulations?

Accepted Answer

A)  Annual Audits 
B)  Claims Management 
C)  Salary disbursement to the workforce having direct treatment relationships. 
D)  Life Insurance underwriting 
E)  Cash given to the pharmacist for the purchase of an over-the-counter drug medicine

Question 16

Select the FALSE statement regarding the X12N Implementation Guides.

Accepted Answer

A)  The Washington Publishing Company has the exclusive rights to publish the X12N Implementation Guides. 
B)  HHS has adopted the Implementation Guides as standards for HIPAA transactions. 
C)  The guides are intended to be instructive and need not be followed strictly. 
D)  The guides may be downloaded free from WPC's Website. 
E)  The guides explain the usage of the transaction set segments and data elements.

Question 17

The National Provider Identifier (NPI) will eventually replace the:

Accepted Answer

A)  NPF 
B)  NPS 
C)  CDT 
D)  ICD-9-CM, Volume 3 
E)  UPIN

Question 18

The Final Privacy Rule requires a covered entity to obtain an individual's prior written authorization to use his or her PHI for marketing purposes except for:

Accepted Answer

A)  Situations where the marketing is for a drug or treatment could improve the health of that individual. 
B)  Situations where the patient has already signed the covered entity's Notice of Privacy Practices. 
C)  A face-to-face encounter with the sales person of a company that provides drug samples. 
D)  A communication involving a promotional gift of nominal value. 
E)  The situation where the patient has signed the Notice of Privacy Practices of the marketer.

Question 19

Which of the following is NOT a correct statement regarding HIPAA requirements?

Accepted Answer

A)  A covered entity must change its policies and procedures to comply with HIPAA regulations, standards, and implementation specifications. 
B)  A covered entity must reasonably safeguard PHI from any intentional or unintentional use or disclosure that is in violation of the regulations. 
C)  A covered entity must provide a process for individuals to make complaints concerning privacy issues. 
D)  A covered entity must document all complaints received regarding privacy issues. 
E)  The Privacy Rule requires that the covered entity has a documented security policy.

Question 20

Which of the following is a required implementation specification associated with the Contingency Plan Standard?

Accepted Answer

A)  Integrity Controls 
B)  Access Control and Validation Procedures 
C)  Emergency Mode Operation Plan 
D)  Response and Reporting 
E)  Risk Analysis

Exam 1: Certified HIPAA Professional (CHP)

Select the best statement regarding the definition of the term "use" as used by the HIPAA regulations.

Select the best statement regarding de-identified information (DII) .

Select the correct statement regarding code sets and identifiers.

The objective of this document is to safeguard the premises and building from unauthorized physical access and to safeguard the equipment therein from unauthorized physical access, tampering and theft:

To comply with the Final Privacy Rule, a valid Notice of Privacy Practices:

Use or disclosure of Protected Health Information (PHI) for Treatment, Payment, and Health care Operations (TPO) is:

The National Provider Identifier (NPI) will eventually replace the:

The objective of this HIPAA security standard is to implement policies and procedures to prevent, detect, contain, and correct security Violations.

When submitting a Health Care Claim Status Request, it is important to provide the proper tracking information to exactly identify the previously submitted claim Select the information that would be most important to the claim inquiry/ process.

The implementation specifications for this HIPAA security standard (within Technical Safeguards) must support emergency access and unique user identification.

This code set describes drugs:

The Security Rule requires that the covered entity identifies a security official who is responsible for the development and implementation of the policies and procedures. This is addressed under which security standard?

Which of the following is example of "Payment" as defined in the HIPAA regulations?

Select the FALSE statement regarding the X12N Implementation Guides.

The National Provider Identifier (NPI) will eventually replace the:

The Final Privacy Rule requires a covered entity to obtain an individual's prior written authorization to use his or her PHI for marketing purposes except for:

Which of the following is NOT a correct statement regarding HIPAA requirements?

Which of the following is a required implementation specification associated with the Contingency Plan Standard?