I85PREP
⌘ K
CHPC study materials
CHPC study resources

CHPC practice questions

One question at a time. Build your CHPC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Privacy Program Foundations, Governance, and Oversight

Under the HIPAA Privacy Rule, which responsibility belongs to a covered entity's designated privacy official?

  1. Maintaining the organization's network firewalls
  2. Conducting the annual financial audit
  3. Negotiating reimbursement contracts with payers
  4. Developing and implementing privacy policies Correct answer.

Explanation

The Privacy Rule requires each covered entity to designate a privacy official responsible for developing and implementing its privacy policies and procedures. The role also typically includes receiving complaints and supporting workforce training. The other activities belong to finance, contracting, or information security functions.

Question 2Privacy Program Foundations, Governance, and Oversight

Which of the following is one of the seven elements of an effective compliance program described in federal guidance?

  1. Well-publicized disciplinary guidelines Correct answer.
  2. Annual shareholder dividend review process
  3. Quarterly earnings guidance publication
  4. Marketing plan approval workflow

Explanation

Federal compliance program guidance identifies seven elements, including written standards, designated compliance leadership, training and education, monitoring and auditing, and well-publicized disciplinary guidelines. These elements are designed to prevent, detect, and correct violations.

Question 3Privacy Program Foundations, Governance, and Oversight

Which document must a covered health care provider give to patients describing how their health information may be used and disclosed?

  1. Business associate agreement
  2. Authorization for research
  3. Accounting of disclosures report
  4. Notice of Privacy Practices Correct answer.

Explanation

The Privacy Rule requires covered entities to provide a Notice of Privacy Practices that describes permitted uses and disclosures and explains patient rights. It must be furnished at the first service delivery and posted prominently.

Question 4Privacy Program Foundations, Governance, and Oversight

The minimum necessary standard requires a covered entity to do what when using or disclosing PHI for non-treatment purposes?

  1. Disclose the full record to avoid withholding information
  2. Limit PHI to what is needed for the purpose Correct answer.
  3. Notify OCR before each disclosure
  4. Obtain a notarized authorization each time

Explanation

The minimum necessary standard requires reasonable efforts to limit PHI to the amount needed to accomplish the intended purpose. It applies to most uses and disclosures but not to treatment disclosures or disclosures to the individual.

Question 5Privacy Program Foundations, Governance, and Oversight

Who within a covered entity must receive privacy training under the HIPAA Privacy Rule?

  1. Only physicians and nurses
  2. All workforce members who may encounter PHI Correct answer.
  3. Only employees with access to billing systems
  4. Only the privacy official

Explanation

Training must reach all workforce members who handle PHI or could encounter it in their work, not only clinicians. Workforce is defined broadly to include employees, volunteers, trainees, and contractors.

Question 6Privacy Program Foundations, Governance, and Oversight

A covered entity must have a business associate agreement in place when a vendor does which of the following?

  1. Provides janitorial services in a building with no access to PHI
  2. Sells office supplies to the entity
  3. Advertises the entity's services in a newspaper
  4. Creates, receives, maintains, or transmits PHI for the entity Correct answer.

Explanation

A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity. A written agreement is required before PHI is shared with such a vendor.

Question 7Privacy Program Foundations, Governance, and Oversight

A covered entity's privacy program must include a sanctions policy that does what?

  1. Applies only to the privacy official
  2. Replaces the need for periodic workforce training
  3. Covers workforce members who violate privacy rules Correct answer.
  4. Is optional for small medical practices

Explanation

A sanctions policy documents consequences for workforce members who fail to comply with privacy policies. It must apply across the workforce and is expected as part of an effective compliance program.

Question 8Privacy Program Foundations, Governance, and Oversight

Which governance practice best demonstrates executive oversight of a health care privacy program?

  1. Receiving regular privacy metrics and risk updates Correct answer.
  2. Delegating all privacy decisions to the IT help desk
  3. Limiting privacy reporting to the compliance committee annually
  4. Reviewing privacy policies only after a breach occurs

Explanation

Executive and board oversight is demonstrated when leadership receives recurring, meaningful reporting on privacy risks and metrics. Reactive reviews or delegating privacy to the help desk do not establish governance accountability.

Question 9Privacy Program Foundations, Governance, and Oversight

In privacy program documentation, what distinguishes a policy from a procedure?

  1. A policy is optional, while a procedure is mandatory
  2. A policy states the principle; a procedure gives the steps Correct answer.
  3. A policy is written by external counsel; a procedure is written by IT
  4. A policy applies to patients, while a procedure applies to vendors

Explanation

Policies articulate the organization's position and requirements, while procedures describe how staff carry them out. Both are required program documents and may be drafted by various functions.

Question 10Privacy Program Foundations, Governance, and Oversight

How does the role of the privacy official differ from that of the security official?

  1. Privacy covers policies and patient rights; security covers ePHI safeguards Correct answer.
  2. The two roles must always be held by the same person
  3. The privacy official manages firewalls, while the security official handles complaints
  4. The privacy official is optional, while the security official is required

Explanation

The privacy official focuses on the Privacy Rule, patient rights, and use and disclosure policies. The security official focuses on administrative, physical, and technical safeguards for electronic PHI. One person may hold both roles, but the responsibilities remain distinct.

Question 11Privacy Program Foundations, Governance, and Oversight

Which activity best supports a privacy program's identification of gaps before they become violations?

  1. Reviewing only the policies of peer institutions
  2. Conducting periodic privacy risk assessments of PHI flows Correct answer.
  3. Waiting for OCR to issue a finding
  4. Relying on staff to self-report all errors

Explanation

Periodic risk assessments identify where PHI flows, who can access it, and where controls are weak. This allows the organization to remediate gaps proactively rather than waiting for external findings.

Question 12Privacy Program Foundations, Governance, and Oversight

When a state law imposes stricter privacy protections than HIPAA, how should a covered entity resolve the conflict?

  1. Follow the more stringent state law Correct answer.
  2. Follow HIPAA because federal law always controls
  3. Choose the less burdensome requirement
  4. Ignore both and follow the entity's own policy

Explanation

HIPAA sets a federal floor, and more stringent state privacy laws are not preempted. Covered entities must comply with whichever requirement provides greater privacy protection or greater patient rights.

Question 13Privacy Program Foundations, Governance, and Oversight

Which practice best supports a covered entity's obligation to receive and respond to privacy complaints?

  1. Forwarding all complaints to the patient's insurer
  2. Accepting complaints only from employees
  3. Logging each complaint, investigation, and resolution Correct answer.
  4. Responding verbally only, to avoid creating a record

Explanation

Covered entities must have a process for receiving and addressing complaints, and documentation supports oversight and trend analysis. Complaints may come from patients, family members, or others, not just employees.

Question 14Privacy Program Foundations, Governance, and Oversight

For which of the following must a covered entity maintain an accounting of disclosures?

  1. Disclosures made to the patient directly
  2. Disclosures to a public health authority for reporting Correct answer.
  3. Disclosures to the patient's treating physician for treatment
  4. Disclosures authorized by the patient in writing

Explanation

The accounting of disclosures excludes disclosures for treatment, payment, and health care operations, disclosures to the individual, and disclosures made under a valid authorization. Required public health reporting is generally subject to accounting.

Question 15Privacy Program Foundations, Governance, and Oversight

A business associate engages a subcontractor that will create and maintain PHI on its behalf. What is required?

  1. Nothing, because the subcontractor is not a covered entity
  2. The covered entity must sign the BAA directly with the subcontractor in all cases
  3. The subcontractor must be reported to OCR before work begins
  4. The business associate must obtain written assurances from the subcontractor Correct answer.

Explanation

Business associates must ensure that subcontractors that create, receive, maintain, or transmit PHI agree in writing to the same restrictions and conditions. The covered entity does not typically contract directly with the subcontractor.

Question 16Privacy Program Foundations, Governance, and Oversight

When should privacy training be provided to a newly hired workforce member who will handle PHI?

  1. Only if the member requests it
  2. Before PHI access, then periodically Correct answer.
  3. Within twelve months of the hire date
  4. Only after an incident occurs

Explanation

Training should occur before or promptly after a workforce member gains access to PHI, with periodic refreshers. This ensures staff understand the policies before they handle patient information.

Question 17Privacy Program Foundations, Governance, and Oversight

Which activity is an example of proactive privacy monitoring?

  1. Waiting for patients to file complaints
  2. Investigating a breach after OCR notifies the entity
  3. Reviewing privacy policies during a merger only
  4. Auditing access logs to detect unauthorized viewing Correct answer.

Explanation

Proactive monitoring uses audits, access reviews, and rounding to detect problems before they escalate. Reactive activities such as responding to complaints or external notices are not monitoring.

Question 18Privacy Program Foundations, Governance, and Oversight

Which action most clearly demonstrates an organization's commitment to a culture of privacy compliance?

  1. Publishing the privacy policy only on an internal bulletin board
  2. Assigning privacy duties to the IT department as a secondary task
  3. Leaders model privacy behavior and hold staff accountable Correct answer.
  4. Decreasing privacy training to reduce staff workload

Explanation

A culture of compliance is driven by visible leadership commitment and consistent accountability. Written policies alone, without leadership modeling, do not establish culture.

Question 19Privacy Program Foundations, Governance, and Oversight

Which approach best reflects sound governance for retaining privacy program documentation?

  1. Following a documented retention schedule Correct answer.
  2. Retaining every document indefinitely without a schedule
  3. Keeping records only if a lawsuit is filed
  4. Destroying policies immediately after they are superseded

Explanation

A documented retention schedule sets consistent periods for maintaining and destroying records based on legal and operational needs. It supports defensibility and prevents both premature destruction and indefinite accumulation.

Question 20Privacy Program Foundations, Governance, and Oversight

A university operates a hospital and a non-health-care academic department. It designates the hospital as its health care component. What is this structure called?

  1. An affiliated covered entity
  2. An organized health care arrangement
  3. A hybrid entity Correct answer.
  4. A business associate arrangement

Explanation

A hybrid entity is an organization that performs both covered and non-covered functions and designates its health care component. Only the designated component is subject to the Privacy Rule.

Question 21Privacy Program Foundations, Governance, and Oversight

Two independent hospitals share a joint notice of privacy practices and jointly conduct utilization review. What structure have they formed?

  1. An organized health care arrangement Correct answer.
  2. A hybrid entity
  3. A covered entity's health care clearinghouse
  4. A group health plan

Explanation

An organized health care arrangement allows clinically integrated entities to share a joint notice and treat one another as a single entity for certain privacy purposes. It does not merge the participating organizations.

Question 22Privacy Program Foundations, Governance, and Oversight

Several legally separate covered entities under common ownership designate themselves as a single covered entity for privacy purposes. What is this designation called?

  1. An affiliated covered entity Correct answer.
  2. A hybrid entity
  3. An organized health care arrangement
  4. A health care clearinghouse

Explanation

An affiliated covered entity is a group of covered entities under common ownership or control that designate themselves as a single covered entity. This permits unified policies and a single notice across the group.

Question 23Privacy Program Foundations, Governance, and Oversight

A covered entity wants to use PHI for research without patient authorization. Which path is acceptable under the Privacy Rule?

  1. Rely on the treating physician's implied consent
  2. Use the PHI freely because research is a health care operation
  3. Obtain only verbal agreement from the principal investigator
  4. Obtain an IRB or privacy board waiver of authorization Correct answer.

Explanation

Research uses and disclosures generally require authorization unless an institutional review board or privacy board grants a waiver based on specified criteria. Research is not a health care operation, so the treatment, payment, and operations exceptions do not apply.

Question 24Privacy Program Foundations, Governance, and Oversight

Which disclosure falls outside the scope of the minimum necessary standard?

  1. A disclosure to a treating physician for the patient's treatment Correct answer.
  2. A disclosure to an attorney for a malpractice defense
  3. A disclosure to a public health authority for reporting
  4. A disclosure to a vendor for billing services

Explanation

The minimum necessary standard does not apply to disclosures to a health care provider for treatment or to the individual. It does apply to most other disclosures, including public health reporting and vendor functions.

Question 25Applicable Privacy Laws, Regulations, and Standards

Which organization is a covered entity under the HIPAA Administrative Simplification rules?

  1. A law firm that advises hospitals on malpractice defense
  2. A health care claims clearinghouse Correct answer.
  3. A retailer that sells fitness trackers directly to consumers
  4. An advertising agency that buys de-identified claims data

Explanation

HIPAA recognizes three categories of covered entities: health plans, health care providers that transmit health information electronically in connection with standard transactions, and health care clearinghouses. A clearinghouse that processes or reformats health data for other entities falls squarely within the third category.

Question 26Applicable Privacy Laws, Regulations, and Standards

The HIPAA minimum necessary standard requires a covered entity to do which of the following when using or disclosing PHI?

  1. Obtain written authorization for every internal use of PHI
  2. Disclose only the entire record that contains the requested information
  3. Apply the same limit to all disclosures, including those to the patient
  4. Limit PHI to the amount reasonably necessary for the purpose Correct answer.

Explanation

The minimum necessary standard requires covered entities to make reasonable efforts to limit uses, disclosures, and requests for PHI to the least amount needed to accomplish the intended purpose. It applies to routine and non-routine uses and disclosures, subject to defined exceptions.

Question 27Applicable Privacy Laws, Regulations, and Standards

Under the HIPAA Breach Notification Rule, how long does a covered entity have to notify affected individuals after discovering a breach of unsecured PHI?

  1. Within 120 days
  2. Within 24 hours
  3. Within 60 days Correct answer.
  4. Within 30 days

Explanation

Individual notice must be provided without unreasonable delay and no later than 60 days after discovery of the breach. Breaches affecting 500 or more individuals in a state or jurisdiction also trigger timely media notice and concurrent notice to HHS.

Question 28Applicable Privacy Laws, Regulations, and Standards

The HIPAA de-identification safe harbor requires removal of how many categories of identifiers?

  1. 8
  2. 12
  3. 15
  4. 18 Correct answer.

Explanation

The safe harbor method requires removal of the 18 specified identifiers, including names, geographic subdivisions smaller than a state, dates more specific than year, and full-face photographs. The covered entity also must have no actual knowledge that the remaining information could identify an individual.

Question 29Applicable Privacy Laws, Regulations, and Standards

A hospital contracts with a cloud vendor that will store PHI on the hospital's behalf. What must the hospital obtain?

  1. That the vendor become a covered entity
  2. A patient authorization for each record stored
  3. A signed business associate agreement Correct answer.
  4. Nothing, because data storage is not a HIPAA function

Explanation

A business associate is a person or entity that performs functions involving PHI on behalf of a covered entity, and the relationship must be documented in a written business associate agreement. The agreement obligates the vendor to safeguard the information and to meet applicable HIPAA requirements.

Question 30Applicable Privacy Laws, Regulations, and Standards

Which practice is prohibited by Title I of the Genetic Information Nondiscrimination Act?

  1. An employer offering a voluntary wellness program
  2. A researcher studying genetic markers under informed consent
  3. A hospital asking about family history for clinical care
  4. An insurer using genetic test results to set premiums Correct answer.

Explanation

GINA Title I prohibits health insurers from using genetic information in eligibility determinations, underwriting, and premium setting, and bars them from requesting or requiring genetic testing. Title II imposes related restrictions on employers.

Question 31Applicable Privacy Laws, Regulations, and Standards

How does the HIPAA Privacy Rule treat psychotherapy notes?

  1. They are treated the same as the rest of the medical record
  2. A separate authorization is generally required Correct answer.
  3. They may not be maintained by a provider at all
  4. They may be released to family members on request

Explanation

Psychotherapy notes are maintained separately from the rest of the record and generally require a specific authorization for disclosure. Limited exceptions exist, such as use by the originator for treatment and certain legally mandated disclosures.

Question 32Applicable Privacy Laws, Regulations, and Standards

A state enacts a law that gives patients greater privacy protection than HIPAA requires. What is the effect?

  1. HIPAA preempts the state law entirely
  2. The state law applies only to non-covered entities
  3. Providers may follow whichever rule costs less to implement
  4. The more protective state law generally controls Correct answer.

Explanation

HIPAA sets a federal floor, and a state law that is contrary to HIPAA but more stringent in protecting privacy is not preempted. Covered entities must therefore follow the stricter requirement.

Question 33Applicable Privacy Laws, Regulations, and Standards

A licensed alcohol and drug treatment program wants to send a patient's record to the patient's cardiologist. What is required under 42 CFR Part 2?

  1. Written consent meeting Part 2 requirements Correct answer.
  2. Nothing beyond HIPAA treatment disclosure rules
  3. A subpoena issued by the cardiologist
  4. Approval from the state substance abuse authority

Explanation

Part 2 programs may disclose records of substance use disorder treatment only with the patient's written consent that contains the elements the regulation specifies, such as the recipient, purpose, and expiration, unless a specific exception applies. HIPAA's treatment exception by itself does not authorize the disclosure.

Question 34Applicable Privacy Laws, Regulations, and Standards

When a patient requests an accounting of disclosures, how far back must the covered entity report?

  1. 12 months
  2. 2 years
  3. 6 years Correct answer.
  4. 3 years

Explanation

The accounting must cover disclosures during the six years prior to the request, not including periods before the entity's compliance date. Disclosures for treatment, payment, and health care operations, and those made to the individual or under an authorization, are excluded.

Question 35Applicable Privacy Laws, Regulations, and Standards

A patient asks for a copy of her medical record. Under HIPAA, what is the outer limit for the covered entity to provide access?

  1. 60 days, with no extension available
  2. 10 business days, with no extensions permitted
  3. 21 days from the date of the request
  4. 30 days, extendable once by 30 days Correct answer.

Explanation

A covered entity must act on a request for access within 30 days, and may extend the deadline once by up to 30 additional days if it gives the individual written notice of the reason and the expected date.

Question 36Applicable Privacy Laws, Regulations, and Standards

A local health department requests a list of patients diagnosed with a reportable communicable disease. Under HIPAA, the hospital may:

  1. Provide only de-identified data in all cases
  2. Disclose the PHI without authorization as required by law Correct answer.
  3. Refuse, because public health reporting requires patient authorization
  4. Require the health department to obtain a court order

Explanation

The Privacy Rule permits disclosures to public health authorities authorized by law to collect information for preventing or controlling disease, and it permits disclosures required by law. Neither authorization nor a court order is needed for these routine reports.

Question 37Applicable Privacy Laws, Regulations, and Standards

An IRB wants to approve research using PHI without patient authorization. Which finding must the IRB make?

  1. All identifiers will be destroyed within twelve months
  2. The principal investigator is employed by the covered entity
  3. The research could not practicably be done without it Correct answer.
  4. The research is funded by a federal agency

Explanation

A waiver of authorization requires the IRB or privacy board to find that the use involves no more than minimal risk to privacy, that the waiver will not adversely affect rights and welfare, that the research could not practicably be conducted without the waiver, and that identifiers will not be reused or disclosed improperly.

Question 38Applicable Privacy Laws, Regulations, and Standards

A hospital wants to mail patients a brochure about a brand-name drug and will be paid by the drugmaker. Under HIPAA this communication is:

  1. Marketing that requires patient authorization Correct answer.
  2. Allowed because it is sent by first-class mail
  3. A permitted health care operations activity
  4. Treatment communication, permitted without authorization

Explanation

A communication that encourages recipients to purchase a product or service and for which the covered entity receives remuneration is marketing and generally requires authorization. Exceptions include face-to-face communications and promotional gifts of nominal value.

Question 39Applicable Privacy Laws, Regulations, and Standards

Under HITECH, when may a covered entity disclose PHI for remuneration without patient authorization?

  1. For public health, research, and certain treatment purposes Correct answer.
  2. Whenever the fee covers the cost of copying
  3. Only if the buyer is another covered entity
  4. Never, under any circumstance

Explanation

HITECH prohibits the sale of PHI without authorization but lists exceptions, including public health activities, research where the price reflects a reasonable cost of preparation, treatment, and certain other purposes. Fees limited to the reasonable cost of copying records in response to a request are not treated as a sale.

Question 40Applicable Privacy Laws, Regulations, and Standards

A 16-year-old consents to a service under state law and asks that the record be kept confidential. Which source determines whether a parent may access that record?

  1. The federal Common Rule
  2. HIPAA alone, because it sets the age of majority
  3. State law, which defines the minor's ability to consent Correct answer.
  4. The Joint Commission standards

Explanation

HIPAA defers to state law on whether a minor may consent to care and who may exercise rights over the record, while granting the minor control when state law allows the minor to consent. The underlying determination is therefore made by state law.

Question 41Applicable Privacy Laws, Regulations, and Standards

Privacy of a university clinic's records that also function as education records is governed by which statute?

  1. GINA
  2. HIPAA, because a clinic created them
  3. 42 CFR Part 2
  4. FERPA, which applies to education records Correct answer.

Explanation

HIPAA expressly excludes education records covered by FERPA, as well as treatment records defined under FERPA's implementing statute, from the definition of protected health information. FERPA therefore governs those records.

Question 42Applicable Privacy Laws, Regulations, and Standards

Under the EU General Data Protection Regulation, processing of health data is generally:

  1. Prohibited for all private organizations
  2. Governed solely by each member state's hospital regulations
  3. Allowed whenever the individual does not object
  4. Only if an Article 9 condition and lawful basis apply Correct answer.

Explanation

Health data is a special category of personal data under Article 9, so processing requires both a lawful basis under Article 6 and a specific Article 9 condition, such as explicit consent or the provision of health care.

Question 43Applicable Privacy Laws, Regulations, and Standards

How is a hospital's PHI generally treated under comprehensive state consumer privacy laws such as the CCPA/CPRA?

  1. Fully covered as ordinary personal information
  2. Prohibited from any state regulation
  3. Exempt only if the patient opts out
  4. Exempt where HIPAA governs the data Correct answer.

Explanation

Most comprehensive state privacy laws exempt protected health information and entities regulated by HIPAA, leaving that data to the federal framework. The exemption is typically limited, so data the hospital holds outside its HIPAA-regulated role may still be covered.

Question 44Applicable Privacy Laws, Regulations, and Standards

Under the CMS Conditions of Participation for hospitals, which requirement applies to patient records?

  1. Records must be maintained in paper form
  2. Patients may inspect records only after discharge
  3. Records must be retained for 21 years
  4. Records must be kept confidential Correct answer.

Explanation

The Conditions of Participation require hospitals to safeguard the confidentiality of patient records and to protect the patient's right to personal privacy. Related patient rights provisions also require hospitals to inform patients of these protections.

Question 45Applicable Privacy Laws, Regulations, and Standards

After discovering an impermissible use or disclosure of PHI, a covered entity's first step in deciding whether notification is required is to:

  1. Terminate the employee responsible for the incident
  2. Notify HHS immediately in every case
  3. Perform a documented four-factor risk assessment Correct answer.
  4. Notify the media in the affected geographic area

Explanation

An impermissible use or disclosure is presumed to be a breach unless the entity demonstrates a low probability that the PHI was compromised, which requires a documented risk assessment considering the nature and extent of the information, the unauthorized recipient, whether the information was actually acquired or viewed, and the extent of mitigation.

Question 46Applicable Privacy Laws, Regulations, and Standards

How do HIPAA and 42 CFR Part 2 interact for records held by a federally assisted substance use disorder program?

  1. Both apply; the more stringent rule controls Correct answer.
  2. Part 2 replaced HIPAA for those records
  3. Part 2 applies only to paper records
  4. HIPAA controls because it is the later federal statute

Explanation

Records covered by Part 2 remain protected health information under HIPAA, so covered entities must satisfy both bodies of law. Where the two conflict, the more stringent requirement generally governs, which typically means Part 2's stricter consent rules.

Question 47Applicable Privacy Laws, Regulations, and Standards

Which disclosure is exempt from the HIPAA minimum necessary standard?

  1. A disclosure to an accountant for a billing audit
  2. A disclosure to a vendor preparing a patient mailing
  3. A disclosure to a health plan for payment review
  4. A disclosure to a physician treating the patient Correct answer.

Explanation

Minimum necessary does not apply to disclosures to or requests by a health care provider for treatment, disclosures to the individual, uses or disclosures made pursuant to a valid authorization, disclosures to HHS for compliance reviews, or uses and disclosures required by law.

Question 48Applicable Privacy Laws, Regulations, and Standards

A patient requests an accounting of disclosures. Which disclosure must appear in the accounting?

  1. A disclosure made to the patient
  2. A disclosure made under a valid authorization
  3. A disclosure to a health plan for payment
  4. A disclosure to police under a court order Correct answer.

Explanation

The accounting excludes disclosures for treatment, payment, and health care operations, disclosures to the individual, disclosures under an authorization, and a few other listed categories. Disclosures compelled by court order or legal process must be tracked and reported.

Question 49Applicable Privacy Laws, Regulations, and Standards

Which law applies to a direct-to-consumer period-tracking app that is not covered by HIPAA and experiences a breach of users' health data?

  1. The FTC Health Breach Notification Rule Correct answer.
  2. 42 CFR Part 2
  3. The Common Rule
  4. The HIPAA Breach Notification Rule

Explanation

The FTC Health Breach Notification Rule covers vendors of personal health records and related entities that are not subject to HIPAA, requiring notice to affected consumers, the FTC, and in some cases the media. It fills the gap left when a health app falls outside HIPAA's covered entity definitions.

Question 50Applicable Privacy Laws, Regulations, and Standards

A hospital engages an outside cloud vendor to store and transmit patients' electronic protected health information on the hospital's behalf. Under HIPAA, how is the vendor best characterized?

  1. A personal representative of the patients
  2. A subcontractor with no HIPAA obligations
  3. A covered entity in its own right
  4. A business associate of the hospital Correct answer.

Explanation

HIPAA defines a business associate as a person or entity that performs functions or activities involving PHI on behalf of, or provides services to, a covered entity. The cloud vendor stores and transmits PHI for the hospital, so it fits that definition and a written business associate agreement is required.