Free Practice Questions for HIPAA HIO-201 Exam

Question 1

Select the FALSE statement regarding health-related communications and marketing in The I-IIPAA regulations:

AA covered entity must obtain an authorization for any use or disclosure of protected health information for marketing, except if the communication is in the form allowed by the regulations.

BA face-to-face communication made by a covered entity to an individual is allowed by the regulations without an authorization.

CA promotional gift of nominal value provided by the covered entity is NOT allowed by the regulations without an authorization.

DIf the marketing is expected to result in direct or indirect remuneration to the covered entity from a third party, the authorization must state that such remuneration is expected.

EDisclosure of PHI for marketing purposes is limited to disclosure to business associates (which could be a telemarketer) that undertakes marketing activities on behalf of the covered entity.

Correct Answer: C. A promotional gift of nominal value provided by the covered entity is NOT allowed by the regulations without an authorization.

Question 2

The Privacy Rule gives patients the following right

AAccess to the psychotherapy notes.

BRequest an amendment to their medical record.

CReceive a digital certificate.

DSee an accounting of disclosures for which authorization was given.

EThe use of a smart card for accessing their records.

Correct Answer: B. Request an amendment to their medical record.

Question 3

Health information is protected by the Privacy Rule as long as:

AThe authorization has been revoked by the physician

BThe patient remains a citizen of the United States.

CThe information is under the control of HHS.

DThe information is in the possession of a covered entity.

EThe information is not also available on paper forms.

Correct Answer: D. The information is in the possession of a covered entity.

Question 4

Select the correct statement regarding the administrative requirements of the HIPAA privacy rule

AA covered entity must apply disciplinary sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity.

BA covered entity need not train all members of its workforce whose functions are materially affected by a change in policy or procedure

CA covered entity must designate, and document, a contact person responsible for receiving acknowledgements of Notice of Privacy Practice.

DA covered entity may require individuals to waive their rights.

EA covered entity must provide maximum safeguards for PHI from any intentional or unintentional use or disclosure that is in violation of the regulations and to limit incidental uses and disclosures made pursuant to permitted or required use or disclosure.

Correct Answer: A. A covered entity must apply disciplinary sanctions against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity.

Question 5

The best example of a party that would use the 835 - Health Care Claim Payment/Advice transaction is:

AHHS

BA community health management information system.

CHealth statistics collection agency.

DGovernment agency.

EInsurance Company.

Correct Answer: E. Insurance Company.

Question 6

This requires records of the movement of hardware and electronic media that contain PHI.

ABusiness Associate Contract

BData Backup Plan

CMedia Re-use

DDisposal

EAccountability

Correct Answer: E. Accountability

Question 7

HIPAA transaction standards apply to:

AEmployee drug tests.

BHealth component of auto insurance.

CStored health information data.

DEligibility inquiries.

ENon-reimbursed employee medical expenses.

Correct Answer: D. Eligibility inquiries.

Question 8

Use or disclosure of Protected Health Information (PHI) for Treatment, Payment, and Health care Operations (TPO) is:

ALimited to the minimum necessary to accomplish the intended purpose.

BLeft to the professional judgment and discretion of the requestor.

CControlled totally by the requestor's pre-existing authorization document.

DGoverned by industry ''best practices'' regarding use.

ELeft in force for eighteen (18) years.

Correct Answer: A. Limited to the minimum necessary to accomplish the intended purpose.

Question 9

Encryption is included as an addressable implementation specification under which security rule standard?

AInformation Access Management

BSecurity Management Process

CEvaluation

DTransmission Security

EDevice and Media Controls

Correct Answer: D. Transmission Security

Question 10

Select the FALSE statement regarding the responsibilities of providers with direct treatment relationships under HIPAA's privacy rule.

AProvide the individual with a Notice of Privacy Practices that describes the use of PHI.

BObtain a written authorization for each and every TPO event.

CObtain a written authorization for any disclosure or use of PHI other than for the purposes of TPO.

DProvide access to the PHI that it maintains to the individual and make reasonable efforts to correct possible errors when requested by the individual.

EEstablish procedures to receive complaints relating to the handling of PHI.

Correct Answer: B. Obtain a written authorization for each and every TPO event.

Question 11

To comply with the Final Privacy Rule, a valid Notice of Privacy Practices:

AIs required for all Business Associate Contracts

BMust always be associated with a valid authorization

CMust be signed before providing treatment to a patient.

DMust be associated with a valid Business Associate Contract

EMust describe the individual's rights under the Privacy Rule.

Correct Answer: E. Must describe the individual's rights under the Privacy Rule.

Question 12

HIPAA establishes a civil monetary penalty for violation of the Administrative Simplification provisions. The penalty may not be more than.

A$1 000000 per person per violation of a single standard for a calendar year

B$10 per person per violation of a single standard for a calendar year.

C$25000 per person per violation of a single standard for a calendar year.

D$2,500 per person per violation of a single standard for a calendar year

E$1000 per person per violation of a single standard for a calendar year

Correct Answer: C. $25000 per person per violation of a single standard for a calendar year.

Question 13

A provider is in compliance with the Privacy Rule. She has a signed Notice of Privacy Practices from her patient. To provide treatment, the doctor needs to consult with an independent provider who has no relationship with the patient To comp with the Privacy Rule the doctor MUST:

AEstablish a business partner relationship with the other provider.

BObtain a signed authorization from the patient to cover the disclosure.

CMake a copy of the signed Notice available to the other provider

DObtain the patients signature on the second providers Notice of Privacy Practices.

EDo nothing more --- the Notice of Privacy Practices covers treatment activities.

Correct Answer: E. Do nothing more --- the Notice of Privacy Practices covers treatment activities.

Question 14

A pharmacist is approached by an individual and asked a question about an over-the-counter medication. The pharmacist needs some protected health information (PHI) from the individual to answer the question. The pharmacist will not be creating a record of this interaction. The Privacy Rule requires the pharmacist to:

AVerbally request a consent and offer a copy of the Notice of Privacy Practices.

BVerbally request specific authorization for the PHI.

CDo nothing more.

DObtain the signature of the patient on their Notice of Privacy Practices.

ENot respond to the request without an authorization from the primary physician.

Correct Answer: C. Do nothing more.

Question 15

The code set that must be used to describe or identify inpatient hospital services and surgical procedures is:

AICD-9-CM, Volumes 1 and 2

BCPT-4

CCDT

DICD-9-CM, Volume 3

EHCPCS

Correct Answer: D. ICD-9-CM, Volume 3