Test your basic knowledge |

HIPAA

Instructions:

Answer 50 questions in 15 minutes.
If you are not ready to take this test, you can study here.
Match each statement with the correct term.
Don't refresh. All questions and answers are randomly picked and ordered every time you load a test.

This is a study tool. The 3 wrong answers for each question are randomly chosen from answers to other questions. So, you might find at times the answers obvious, but you will see it re-enforces your understanding as you take the test each time.

1. Under some circumstances ...
a minor - rather than the parent - must sign the release of patient information
Electronic Protected Health Information
U.S. Department of Health and Human Services (HHS; established national standards for HIPAA) - Centers for Medicare and Medicaid Services (CMS; enforce insurance portability and transaction/code set requirements) - Office for Civil Rights (OCR; enfor
Any information that would identify a patient (name - add - tele - DOB - SSN - email - med. rec. number - etc)

2. DII
regular - in a secure location
Permission
De-Identified Information
need to know

3. In HIPAA language health plans - Health care clearinghouses - and all health care providers that transmit HIPAA standard transactions electronically are called covered entities. Hospitals - nursing homes - hospices - pharmacies - physician practices
addresses portability of insurance coverage when employees change or lose their jobs
Individually Identifiable Health Information
Covered entities
comes on after a few idle seconds and the use of a privacy screen should be mandatory

4. Conforming to proper professional behavior
Ethical
improper performance of an otherwise lawful act. civil
Minimum necessary
De-Identified Information

5. Protected health information from which certain patient identifiers have been removed
U.S. goverment
Designated record set
Limited data set
only those who meed to know should have access to patient information

6. Treatment means that a health care provider can provide care; payment means that a provider can disclose PHI to be reimbursed; health care operations refers to HIPAA approved activities and transactions.
Treatment - payment and health care operations (TPO)
Privacy
concerns noncriminal disputes between private parties
Ethical

7. See & Copy their health records - update health records - obtain a list of the institution's disclosures - other than for payment & healthcare operations - request a restriction on a certain uses or disclosures - choose how to receive their health in
Limited data set
generally only patient can auth release of own medical record - there are a few exceptions
a minor - rather than the parent - must sign the release of patient information
Patient rights under HIPAA

8. Negligence
located in a secured and private space
U.S. Department of Health and Human Services (HHS; established national standards for HIPAA) - Centers for Medicare and Medicaid Services (CMS; enforce insurance portability and transaction/code set requirements) - Office for Civil Rights (OCR; enfor
Medical data from which individual identifiers have been removed; also known as a redacted or blinded record.
failure to act with the standard of care that a reasonable person would exercise under the same circumstances

9. HI
Covered transactions
state law that protects healthcare professionals from liability when they provide emergency assistance/services within their scope of training
Electronic data interchange
Health Information

10. Emancipated minors

11. Who regulates HIPAA?
substance abuse treatment
Firewalls
U.S. goverment
Security

12. Clearinghouse
h/c workers --qualified people of organizations(perf. data processinf or transcript) -certain gov. auth. (pub health activities) -appropriate auth(protect vic. of abuse) -law enforcement officials or judicial orders
safeguards health & wealthfare of Medicare/Medicaid beneficiaries & protect program integrity
a service company that recieves electronic or paper claims from the provider - checks and prepares them for processing - and transmits them in HIPAA-complaint format to the correct carriers
need to know

13. 4d's of negligence
concerns noncriminal disputes between private parties
Duty; duty of care - Derelict; breach of the duty of care - Direct cause; legally recognizable injury occurs as a result of breach of care - Damage; wrongful activity must have been the cause
Electronic data interchange
substance abuse treatment

14. Advanced directives
A court order requiring someone to appear in court on a certain date time and reason. A medical record could be subpoenaed.
state law that protects healthcare professionals from liability when they provide emergency assistance/services within their scope of training
illegal touching of another person
allows patients to give directions to health care providers about treatment choices in circumstances in which the patient may no longer be able to provide that direction. There are two types: Living Will and Durable Power of Attorney

15. Good samaritan law
false and malicious writing about another
state law that protects healthcare professionals from liability when they provide emergency assistance/services within their scope of training
concerned with mostly with h/c providers. It addresses fraud and abuse - administrative simplification and medical liability
Limited data set

16. Releasing patient information
Electronic transmission
allows patients to give directions to health care providers about treatment choices in circumstances in which the patient may no longer be able to provide that direction. There are two types: Living Will and Durable Power of Attorney
State preemption
generally only patient can auth release of own medical record - there are a few exceptions

17. TPO
Transaction
treatment - payment - & healthcare operations
concerns noncriminal disputes between private parties
Designated record set

18. EPHI
Security
Electronic Protected Health Information
it must have an accompanying disclaimer stating the fax information cannot be shared with any other party w/o patient's written consent
false charges and malicious oral statements about someone

19. Professional Negligence
A court order requiring someone to appear in court on a certain date time and reason. A medical record could be subpoenaed.
Notice of Privacy Practices
malpractice
Examples of PHI

20. De-Identified Information
Limited data set
failure to act with the standard of care that a reasonable person would exercise under the same circumstances
Medical data from which individual identifiers have been removed; also known as a redacted or blinded record.
generally only patient can auth release of own medical record - there are a few exceptions

21. Battery
illegal touching of another person
Any information that would identify a patient (name - add - tele - DOB - SSN - email - med. rec. number - etc)
generally only patient can auth release of own medical record - there are a few exceptions
should only be used when no other - more secure mode of transmission is available

22. Federal law protects patient records dealing with...
false and malicious writing about another
Psychotherapy notes - information for legal proceedings - information exempted from disclosure under CLIA
substance abuse treatment
Tort

23. Business Associate Agreements applies to...
The body of laws made by states is their own statutory laws
Notice of Privacy Practices (NPP)
individuals such as cleaning staff and consultants who work in the office. These individuals do not need access to patient info but may come in contact while completing their duties
De-Identified Information

24. The use of uniform electronic network protocols to transfer business information between organizations.
Electronic data interchange
Minimum necessary
individuals such as cleaning staff and consultants who work in the office. These individuals do not need access to patient info but may come in contact while completing their duties
Any information that would identify a patient (name - add - tele - DOB - SSN - email - med. rec. number - etc)

25. Implied consent
Covered transactions
false and malicious writing about another
Type of consent in which a patient who is unable to give consent is given treatment under the legal assumption that he or she would want treatment.
state law that protects healthcare professionals from liability when they provide emergency assistance/services within their scope of training

26. What information do patients NOT have access to?
generally only patient can auth release of own medical record - there are a few exceptions
concerns noncriminal disputes between private parties
Type of consent in which a patient who is unable to give consent is given treatment under the legal assumption that he or she would want treatment.
Psychotherapy notes - information for legal proceedings - information exempted from disclosure under CLIA

27. In order for a fax document to be HIPAA compliant...

28. Privacy Officer
State preemption
safeguards health & wealthfare of Medicare/Medicaid beneficiaries & protect program integrity
Security
Every office should have one! - responsible for making surethat thise office is HIPAA compliant - privacy officer should be.. an effective communicator with ability to answer questions about sespected HIPPA violations and complaints

29. A reason for each use and disclosure of patient information.
Permission
generally only patient can auth release of own medical record - there are a few exceptions
A written set of questions requiring written answers from a plaintiff or defendant under oath
State preemption

30. Document that includes the standards
also called biomedical ethics - the moral dilemmas and issues of advanced medicine and medical research
Medical data from which individual identifiers have been removed; also known as a redacted or blinded record.
concerns noncriminal disputes between private parties
Rule

31. IIHI
failure to act with the standard of care that a reasonable person would exercise under the same circumstances
The body of laws made by states is their own statutory laws
Individually Identifiable Health Information
Invasion of Privacy Publishing

32. Some state laws specifically protect __________. A patient would need to sign a specific request.
purpose - pride - patience - persistence - perspective
regular - in a secure location
Prohibits discrimination preventing indiviualds with physical or mental disabilities or chronic illness - from accessing public services & accomodations. Employers requires 'reasonable accommodation' be provided so they can perform duties.
human immunodeficiency virus/acquired immune deficiency syndrome (HIV/AIDS)

33. A general HIPAA requirement
Regulations
Rule
Standard
false and malicious writing about another

34. OIG - Office of the Inspector General
failure to act with the standard of care that a reasonable person would exercise under the same circumstances
malpractice
Regulations
safeguards health & wealthfare of Medicare/Medicaid beneficiaries & protect program integrity

35. Gunshot wound - child abuse - infectious diseases - required by law - law enforcement purposes.
Designated record set
law that permits a person w/ a legal age and sound mind to give their body to donation
What types of disclosures do not require patient permission?
Privacy

36. making known - or using information relating to the private life or affairs of a person without their approval or permission
Individually Identifiable Health Information
Designated record set
located in a secured and private space
Invasion of Privacy Publishing

37. Uniform anotomical gift act
Insurance portability - administrative simplification - privacy and security
Electronic Protected Health Information
testimony under oath
law that permits a person w/ a legal age and sound mind to give their body to donation

38. Deposition
testimony under oath
Notice of Privacy Practices
regular - in a secure location
illegal touching of another person

39. What are the 3 purposes of HIPAA?
De-Identified Information
Electronic Protected Health Information
Insurance portability - administrative simplification - privacy and security
h/c workers --qualified people of organizations(perf. data processinf or transcript) -certain gov. auth. (pub health activities) -appropriate auth(protect vic. of abuse) -law enforcement officials or judicial orders

40. Ethics
the philosophical study of moral values and rules - conducts
Standard
safeguards health & wealthfare of Medicare/Medicaid beneficiaries & protect program integrity
individuals in their mid- to late teens who legally live outside of parents' or guardians' control

41. Title I of HIPAA
in order to maintain patient confidentiality - fax machines must be kept in areas not accessible to patients.
Minimum necessary
a contract that comes about from the actions of the parties rather than words
addresses portability of insurance coverage when employees change or lose their jobs

42. Common law
U.S. Department of Health and Human Services (HHS; established national standards for HIPAA) - Centers for Medicare and Medicaid Services (CMS; enforce insurance portability and transaction/code set requirements) - Office for Civil Rights (OCR; enfor
h/c workers --qualified people of organizations(perf. data processinf or transcript) -certain gov. auth. (pub health activities) -appropriate auth(protect vic. of abuse) -law enforcement officials or judicial orders
judge made law from decisions of a court - interpretation of constitution and statuatory law - often known as precedents
Covered entities

43. Any wrongdoing for which an action for damages may be brought
A written set of questions requiring written answers from a plaintiff or defendant under oath
Invasion of Privacy Publishing
Tort
Designated record set

44. Civil law
addresses portability of insurance coverage when employees change or lose their jobs
law that permits a person w/ a legal age and sound mind to give their body to donation
concerns noncriminal disputes between private parties
state laws setting time limit for bringing a lawsuit

45. Key entities
Notice of Privacy Practices (NPP)
malpractice
U.S. Department of Health and Human Services (HHS; established national standards for HIPAA) - Centers for Medicare and Medicaid Services (CMS; enforce insurance portability and transaction/code set requirements) - Office for Civil Rights (OCR; enfor
What types of disclosures do not require patient permission?

46. Reportable diseases...
Designated record set
Electronic Protected Health Information
must be reported to authorities by law
Patient Identifiable Information

47. Protecting healthcare coverage for employees who change jobs - allowing them to continue existing plans with a new employer.
Electronic Protected Health Information
a service company that recieves electronic or paper claims from the provider - checks and prepares them for processing - and transmits them in HIPAA-complaint format to the correct carriers
Notice of Privacy Practices
Portability

48. The limited amount of patient information to be disclosed - depending on circumstances.
Encryption
parent of a minor - legal guardian - Agent (patient selected on behalf in h/c power of attorney)
Prohibits discrimination preventing indiviualds with physical or mental disabilities or chronic illness - from accessing public services & accomodations. Employers requires 'reasonable accommodation' be provided so they can perform duties.
Minimum necessary

49. Misfeasance
Security
Standard
improper performance of an otherwise lawful act. civil
Duty; duty of care - Derelict; breach of the duty of care - Direct cause; legally recognizable injury occurs as a result of breach of care - Damage; wrongful activity must have been the cause

50. Titile II of HIPAA
Limited data set
concerned with mostly with h/c providers. It addresses fraud and abuse - administrative simplification and medical liability
Firewalls
Electronic data interchange