Test Your HIPAA Knowledge [QUIZ]

Editor’s Note: Links updated, June 2019

Thanks to Chris Apgar, CISSP, President and CEO of Apgar & Associates, LLC for his help in crafting the questions.

1. What does the HIPAA acronym stand for?

1. Health Identification Privacy and Affordability Act
2. Health Information Portability and Affordability Act
3. Health Information Privacy and Accountability Act
4. Health Insurance Portability and Accountability Act

2. Can a provider use the database to access the medical record of a patient who was seen by another provider in the same organization?

1. No, he/she must create a new record for the patient based on his/her personal interactions with the patient.
2. No, he/she must obtain written consent from the patient.
3. Yes, as long as he/she will be treating that patient or the provider is assisting another provider with the coordination of the patient’s care.
4. Yes, he/she can access any information available in the database.

3. A covered entity must obtain an individual’s written authorization for use or disclosure of protected health information in which of the following scenarios?

1. A coder must review a patient’s chart to code a recent hospital stay.
2. A consulting physician needs to access a patient’s record to inform his/her opinion.
3. A hospital administrator needs to access patient data to create a report about how many patients were treated for diabetes in the last six months.
4. None of the above

4. True or false: Patients can request a copy of billing records associated with their care.

1. True
2. False

5. Which division of the Department of Health and Human Services (HHS) is responsible for administering and enforcing HIPAA privacy and security standards?

1. Centers of Medicare and Medicaid Services (CMS)
2. Office of Civil Rights (OCR)
3. Office of Inspector General (OIG)
4. Office of the National Coordinator for Health Information Technology (ONC)

6. True or false: In order for a provider to use a smartphone to contact an answering service, HIPAA requires the phone be encrypted.

1. True
2. False

7. Any healthcare provider, regardless of size, is considered a covered entity under the HIPAA Privacy Rule, so long as the provider:

1. Demonstrates meaningful use of electronic health records (EHR).
2. Electronically transmits health information in connection with certain transactions.
3. Handles health information in any way.
4. Receives reimbursement from a government health program.

8. All of the following pieces of information are considered individually identifiable health information, EXCEPT:

1. Birth date.
2. Diagnosis.
3. Name.
4. Social Security number.

9. True or false: Providers may leave a message on a patient’s answering machine reminding him or her of an upcoming surgery as long as it doesn’t specify the type of surgery or the specialty practice.

1. True
2. False

10. Which of the following scenarios is considered an incidental disclosure?

1. A member of the housekeeping staff overhears two physicians discussing a case in the break room.
2. A nurse practitioner leaves a laptop containing protected health information on the subway.
3. A nurse tells a 10-year-old patient’s parents the details of their child’s case.
4. A physician tells his or her spouse that he saw their neighbor in the hospital.

Take the Quiz to View the Answers!