I85PREP
⌘ K
HCISPP study materials
HCISPP study resources

HCISPP practice questions

One question at a time. Build your HCISPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Healthcare Industry

Under the U.S. HIPAA Privacy Rule, which entity is directly regulated as a covered entity?

  1. A health plan that transmits claims electronically Correct answer.
  2. A patient advocacy nonprofit
  3. A cloud vendor storing backups for a clinic
  4. A medical billing software reseller

Explanation

HIPAA defines covered entities as health plans, healthcare clearinghouses, and healthcare providers that transmit certain administrative transactions electronically. Health plans therefore fall squarely within the definition regardless of size. Vendors that merely support these organizations are business associates, not covered entities.

Question 2Healthcare Industry

A hospital's marketing team wants to send a newsletter to patients about a new wellness program. Under HIPAA, what is required before using patient contact information for this purpose?

  1. A valid written authorization unless the communication qualifies as treatment or health care operations Correct answer.
  2. Nothing, because the program relates to health
  3. Only verbal permission captured in the call notes
  4. A notice posted in the lobby describing the program

Explanation

Marketing communications generally require patient authorization under the HIPAA Privacy Rule. Exceptions exist for face-to-face communications and certain treatment-related or health care operations communications involving limited value gifts. The wellness newsletter generally does not qualify, so written authorization is needed.

Question 3Healthcare Industry

Which security control best supports the HIPAA Security Rule's integrity standard for electronic PHI?

  1. Encrypting data at rest with a managed key
  2. Testing the disaster recovery plan annually
  3. Logging and monitoring changes made to stored records Correct answer.
  4. Requiring badge access to the data center

Explanation

Integrity means protecting ePHI from improper alteration or destruction. Detecting unauthorized changes through logging and monitoring directly addresses that objective. The other controls map more closely to confidentiality or availability.

Question 4Healthcare Industry

A business associate agreement (BAA) is required in which situation?

  1. A covered entity shares a de-identified dataset with a researcher
  2. A janitorial firm cleans a covered entity's offices after hours without touching PHI
  3. A software company hosts an ePHI database for a covered entity Correct answer.
  4. A patient requests a copy of their own record

Explanation

A BAA is required whenever a business associate creates, receives, maintains, or transmits PHI on behalf of a covered entity. Hosting an ePHI database is a classic business associate function. De-identified data and patient access requests fall outside that scope.

Question 5Healthcare Industry

The HIPAA Breach Notification Rule requires a covered entity to notify affected individuals without unreasonable delay and no later than how many days after discovery?

  1. 45 days
  2. 90 days
  3. 60 days Correct answer.
  4. 30 days

Explanation

Individual notification must occur without unreasonable delay and no later than 60 calendar days after discovery of the breach. Media notice for breaches affecting more than 500 residents of a state follows the same 60-day limit. Annual reporting to HHS applies only to smaller breaches.

Question 6Healthcare Industry

A breach affects 800 patients in a single state. Which notification obligations apply under HIPAA?

  1. Notify HHS only, since the number is below 5,000
  2. Notify individuals and the state attorney general only
  3. Notify individuals and HHS only
  4. Notify individuals, HHS, and prominent media outlets serving the state Correct answer.

Explanation

Breaches involving more than 500 individuals in a state or jurisdiction require notice to affected individuals, notice to HHS at the time of the breach, and notice to prominent media outlets. The 500-person threshold is what triggers the media notice. Smaller breaches are logged and reported annually to HHS.

Question 7Healthcare Industry

Which scenario most likely qualifies as a HIPAA breach requiring notification rather than a permissible disclosure?

  1. A billing clerk discloses PHI to a health plan for payment
  2. A nurse shares PHI with a consulting physician for treatment
  3. A provider discloses PHI as required by state law
  4. An unencrypted laptop with PHI is stolen from an employee's car Correct answer.

Explanation

Theft of an unencrypted device containing PHI is presumed to be a breach unless a risk assessment demonstrates low probability of compromise. Treatment, payment, and legally required disclosures are permitted uses. Encryption would have created a safe harbor under the Breach Notification Rule.

Question 8Healthcare Industry

The HIPAA minimum necessary standard applies to which activity?

  1. A quality analyst pulling only the fields needed for a utilization review Correct answer.
  2. A researcher using a fully de-identified dataset
  3. A physician reviewing the full record of a patient under their care
  4. A patient requesting their own complete record

Explanation

The minimum necessary standard limits uses and disclosures to the least amount of PHI needed for the purpose. A quality analyst extracting only necessary fields is applying it correctly. Treatment disclosures to treating providers and patient access requests are excluded from the standard.

Question 9Healthcare Industry

Which is an example of a HIPAA administrative safeguard?

  1. Encryption of ePHI in transit
  2. Automatic logoff on clinical workstations
  3. A workforce security awareness and training program Correct answer.
  4. A locked server room door

Explanation

Administrative safeguards are policies and procedures that manage workforce conduct and access, such as training and sanction policies. Physical safeguards control facility access, and technical safeguards use technology such as encryption and automatic logoff. Recognizing the category helps auditors map controls to the Security Rule.

Question 10Healthcare Industry

A covered entity is evaluating a vendor that will process PHI. Which action best reflects due diligence under HIPAA?

  1. Accept the vendor's standard contract without review
  2. Obtain the vendor's security documentation and negotiate a BAA with required assurances Correct answer.
  3. Defer vendor review until after the contract is signed
  4. Rely on the vendor's marketing claims about certification

Explanation

Covered entities must obtain satisfactory assurances that a business associate will safeguard PHI, typically through a BAA with required terms. Reviewing security documentation supports that assurance. Relying on marketing or postponing review leaves the covered entity exposed.

Question 11Healthcare Industry

Which document typically describes how a covered entity may use and disclose PHI and the patient's rights?

  1. The security risk assessment
  2. The Notice of Privacy Practices Correct answer.
  3. The disaster recovery plan
  4. The business associate agreement

Explanation

The Notice of Privacy Practices informs patients about permitted uses and disclosures, their rights, and the entity's legal duties. It must be provided and posted as required by the Privacy Rule. The other documents serve contractual, risk, or continuity purposes.

Question 12Healthcare Industry

A patient asks a hospital to amend their record because it contains an incorrect allergy entry. Under HIPAA, the hospital must:

  1. Ignore the request because records cannot be changed
  2. Refer the patient to the business associate that hosts the EHR
  3. Consider the request and respond within the required timeframe, possibly denying with a written explanation Correct answer.
  4. Delete the entry immediately upon request

Explanation

HIPAA grants patients a right to request amendment of PHI. The covered entity must act on the request within the regulatory timeframe and may deny it with a written explanation and appeal information in defined circumstances. Deleting records outright is not the required response.

Question 13Healthcare Industry

Which practice best supports the HIPAA de-identification standard for a dataset released for research?

  1. Removing all 18 specified identifiers or obtaining a qualified expert determination Correct answer.
  2. Replacing names with initials
  3. Removing patient names only
  4. Aggregating the data by ZIP code

Explanation

HIPAA permits de-identification through either the safe harbor method, which removes 18 specified identifiers, or expert determination by a qualified statistician. Removing only names leaves many identifiers intact. Partial masking does not meet either method.

Question 14Healthcare Industry

An organization wants to conduct a HIPAA security risk analysis. Which approach is most consistent with the Security Rule?

  1. Assess threats, vulnerabilities, and current controls across the environment, then document a remediation plan Correct answer.
  2. Complete the analysis once at go-live and never repeat it
  3. Outsource the analysis entirely and take no further action
  4. Review only technical controls because administrative controls are optional

Explanation

The Security Rule requires an accurate and thorough assessment of potential risks and vulnerabilities to ePHI, with documented decisions and follow-up. Risk analysis is ongoing, not a one-time event. It must cover administrative, physical, and technical safeguards.

Question 15Healthcare Industry

Under the HITECH Act, business associates are:

  1. Regulated only through state law
  2. Directly subject to certain HIPAA Security Rule provisions and breach notification duties Correct answer.
  3. Exempt from HIPAA Security Rule obligations
  4. Required to appoint a privacy official but not a security official

Explanation

HITECH extended direct application of many Security Rule provisions and breach notification obligations to business associates. They must also designate a security official and comply with the applicable safeguards. This changed the earlier model where only covered entities faced direct enforcement.

Question 16Healthcare Industry

A clinician receives a fax containing another patient's lab results. What is the most appropriate immediate action?

  1. Forward the fax to the intended patient's family
  2. Report the misdirected fax through the incident process and avoid further disclosure Correct answer.
  3. Discard the fax and take no further action
  4. Keep the fax for reference and continue working

Explanation

A misdirected fax is a potential impermissible disclosure that must be reported through the organization's incident response process so it can be assessed and, if needed, notified. The recipient should limit further exposure. Discarding or forwarding the document risks additional disclosure.

Question 17Healthcare Industry

Which statement about the HIPAA Security Rule is accurate?

  1. It applies to PHI in any form, including paper
  2. It applies only to hospitals with more than 500 beds
  3. It applies only to federal agencies
  4. It applies specifically to electronic PHI Correct answer.

Explanation

The Security Rule addresses electronic protected health information, while the Privacy Rule covers PHI in all forms. Size and federal status do not determine applicability. Covered entities and business associates of any size must comply.

Question 18Healthcare Industry

A hospital wants to use a cloud email service that will store messages containing PHI. Which requirement applies?

  1. PHI may be stored only on hospital-owned servers
  2. The hospital may rely on the vendor's privacy policy alone
  3. No agreement is needed if the vendor is large and reputable
  4. A BAA must be executed and the vendor must implement appropriate safeguards Correct answer.

Explanation

A cloud provider that stores PHI on behalf of a covered entity is a business associate and requires a BAA. The agreement should require appropriate safeguards and breach reporting. Vendor reputation or a public privacy policy does not replace the contract.

Question 19Healthcare Industry

Which activity is most likely a violation of the HIPAA Privacy Rule?

  1. A provider shares PHI with a public health authority as required by law
  2. A covered entity discloses PHI for a law enforcement warrant
  3. A provider shares PHI with another provider for a consultation
  4. An employee posts a patient's identifiable photo on social media without authorization Correct answer.

Explanation

Posting identifiable patient information on social media without authorization is an impermissible disclosure. Disclosures to public health authorities, pursuant to a valid law enforcement process, and for treatment consultations are permitted. The medium of disclosure does not change the underlying rule.

Question 20Healthcare Industry

A researcher wants to use PHI under a HIPAA waiver of authorization. Which body typically grants that waiver?

  1. An Institutional Review Board or Privacy Board Correct answer.
  2. The covered entity's marketing department
  3. The business associate hosting the data
  4. The patient's primary care physician

Explanation

HIPAA permits an IRB or Privacy Board to waive or alter the authorization requirement for research under specified criteria. The waiver documents that the research poses minimal risk to privacy and that the plan protects identifiers. Other parties cannot grant this waiver.

Question 21Healthcare Industry

Which control best addresses the HIPAA Security Rule's person or entity authentication standard?

  1. Posting an incident response contact list
  2. Requiring multi-factor authentication for remote access Correct answer.
  3. Reviewing audit logs monthly
  4. Encrypting backups stored offsite

Explanation

Person or entity authentication requires verifying that a person or entity seeking access is who they claim to be. Multi-factor authentication directly supports that verification. Encryption, log review, and contact lists serve other security objectives.

Question 22Healthcare Industry

A state law requires reporting of HIV status to public health authorities with specific confidentiality protections. How should a covered entity reconcile this with HIPAA?

  1. Follow the more stringent requirement where HIPAA permits disclosure Correct answer.
  2. Follow whichever law the patient prefers
  3. Ignore state law because HIPAA preempts it entirely
  4. Refuse all disclosures to public health authorities

Explanation

HIPAA sets a federal floor and generally does not preempt more stringent state laws. Where HIPAA permits a disclosure and state law imposes stricter conditions, the entity must satisfy the stricter requirement. Patient preference does not override legal obligations.

Question 23Healthcare Industry

Which is the best example of a technical safeguard under the HIPAA Security Rule?

  1. A records retention schedule
  2. A workforce sanction policy
  3. Access control mechanisms that restrict ePHI to authorized users Correct answer.
  4. Visitor sign-in at the front desk

Explanation

Technical safeguards use technology to protect ePHI and control access, and access control mechanisms are a required technical safeguard. Workforce sanctions are administrative, and visitor sign-in is physical. Retention schedules are administrative governance tools.

Question 24Healthcare Industry

A business associate discovers a breach of PHI it maintains for a covered entity. What is the business associate's obligation?

  1. Notify the covered entity without unreasonable delay and no later than 60 days after discovery Correct answer.
  2. Notify affected individuals directly and skip the covered entity
  3. Notify HHS only and take no other action
  4. Wait for the covered entity to discover the breach independently

Explanation

A business associate must notify the affected covered entity following discovery of a breach, without unreasonable delay and within 60 days. The covered entity then handles individual, HHS, and media notifications. The business associate does not bypass the covered entity.

Question 25Healthcare Industry

Which situation best illustrates the HIPAA accounting of disclosures requirement?

  1. A provider requests a colleague's login credentials
  2. An auditor requests the security risk analysis
  3. A vendor requests a copy of the BAA
  4. A patient requests a list of disclosures of their PHI made for certain purposes over the prior six years Correct answer.

Explanation

Patients have a right to an accounting of certain disclosures of their PHI, generally covering up to six years. Disclosures for treatment, payment, and health care operations are largely excluded from the accounting. The other scenarios concern access control, contracts, and compliance documentation.

Question 26Healthcare Industry

A health information management professional is mapping the flow of protected health information between a hospital, its accredited continuing education vendor, and a state immunization registry. Which entity classification applies to the state immunization registry that receives PHI without patient authorization for a public health activity?

  1. A personal representative of the patient
  2. A business associate of the hospital under a signed BAA
  3. A covered entity's workforce member
  4. A public health authority acting in its official capacity Correct answer.

Explanation

HIPAA permits disclosure to a public health authority authorized by law to collect information for public health activities, and such an authority receives PHI in its own governmental capacity rather than as a contractor of the hospital. It is therefore neither a business associate nor part of the covered entity's workforce, and it does not act as the patient's personal representative.

Question 27Healthcare Industry

A regional clinic chain is revising its HIPAA policies and wants to distinguish the Privacy Rule's requirements from the Security Rule's requirements. Which obligation originates in the Security Rule rather than the Privacy Rule?

  1. Implementing procedures to record and examine activity in systems containing ePHI Correct answer.
  2. Issuing a notice of privacy practices describing permitted uses of PHI
  3. Honoring a patient's request for an accounting of disclosures
  4. Applying the minimum necessary standard when disclosing PHI to a payer

Explanation

The Security Rule governs electronic PHI and requires administrative, physical, and technical safeguards, including audit controls that record and examine system activity. Notice of privacy practices, minimum necessary limits on disclosures, and accounting of disclosures are all Privacy Rule obligations that apply to PHI in any form.

Question 28Healthcare Industry

A hospital's compliance team is reviewing how the HIPAA Security Rule treats risk management after completing a risk analysis. Which statement best characterizes the required follow-on activity?

  1. Risk management is optional and performed only if budget allows after remediation priorities are set
  2. Risk management applies only to paper records that contain PHI in storage areas
  3. Risk management is satisfied by purchasing cyber liability insurance that covers breach costs
  4. Risk management requires implementing security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level Correct answer.

Explanation

The Security Rule pairs risk analysis with risk management, requiring the entity to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level. The standard is reasonableness judged against the entity's size, complexity, and capabilities, not elimination of all risk or transfer of risk through insurance.

Question 29Healthcare Industry

A covered entity's HIPAA authorization form is being reviewed before use in a research study. Which element must the authorization contain to be valid under the Privacy Rule?

  1. A statement that the covered entity will never disclose the information to any third party
  2. A description of each purpose of the requested use or disclosure Correct answer.
  3. A waiver determination signed by the covered entity's privacy officer
  4. A guarantee that the individual will not revoke the authorization

Explanation

A valid authorization must include core elements such as a description of the information, the persons authorized to disclose and receive it, each purpose of the use or disclosure, an expiration date or event, and the individual's signature and date. It must also include required statements, including the individual's right to revoke and the possibility that information disclosed may be redisclosed.

Question 30Information Governance in Healthcare

Under the HIPAA Privacy Rule, which entity is directly responsible for safeguarding protected health information and is subject to civil and criminal penalties for violations?

  1. A clearinghouse that only routes claims without accessing data
  2. A covered entity such as a hospital or health plan Correct answer.
  3. A patient's family member acting as informal caregiver
  4. A software vendor that has no business associate agreement

Explanation

Covered entities (health plans, clearinghouses, and providers conducting covered transactions) bear direct HIPAA compliance obligations and are the primary targets of enforcement penalties. Business associates inherit obligations through contract, but the covered entity remains accountable to regulators.

Question 31Information Governance in Healthcare

A hospital's compliance officer is mapping how HIPAA, the HITECH Act, and state breach-notification statutes interact. Which statement best describes the relationship among these sources of information governance obligations?

  1. State law always overrides HIPAA because states regulate providers
  2. HITECH repealed the HIPAA Privacy Rule and replaced it entirely
  3. Federal law preempts all state law whenever the two conflict
  4. Stricter state law may apply when it is more protective than HIPAA Correct answer.

Explanation

HIPAA sets a federal floor, and state laws that are more stringent or more protective of privacy generally continue to apply rather than being preempted. HITECH strengthened HIPAA through breach notification and enforcement but did not replace the Privacy Rule.

Question 32Information Governance in Healthcare

Which document type establishes the permitted uses and disclosures of PHI between a covered entity and a vendor that creates, receives, or maintains PHI on its behalf?

  1. Authorization form
  2. Business associate agreement Correct answer.
  3. Notice of Privacy Practices
  4. Data use agreement

Explanation

A business associate agreement is the contract required when a covered entity engages a vendor that handles PHI for it. It specifies permitted uses, safeguards, breach reporting, and termination obligations.

Question 33Information Governance in Healthcare

A covered entity wants to disclose a limited data set to a research partner for a study. Which mechanism is required to permit this disclosure?

  1. A waiver from the Department of Health and Human Services
  2. A signed patient authorization for each record
  3. A data use agreement with the recipient Correct answer.
  4. An accounting of disclosures filed in advance

Explanation

A limited data set may be disclosed for research, public health, or health care operations only if the recipient signs a data use agreement restricting further use and disclosure. Patient authorization is not required for a limited data set handled under such an agreement.

Question 34Information Governance in Healthcare

Under the HIPAA Security Rule, which safeguard category includes contingency planning, access control, and audit controls?

  1. Physical safeguards
  2. Organizational requirements
  3. Technical safeguards Correct answer.
  4. Administrative safeguards

Explanation

The Security Rule groups access control, audit controls, integrity, authentication, and transmission security under technical safeguards. Contingency planning and workforce training fall under administrative safeguards.

Question 35Information Governance in Healthcare

A privacy officer is reviewing a proposed disclosure of psychotherapy notes. Which statement reflects the Privacy Rule requirement for this category of information?

  1. They may be disclosed for treatment without patient authorization
  2. They are treated identically to other PHI under the rule
  3. They may be disclosed for payment purposes without authorization
  4. They require separate patient authorization for most disclosures Correct answer.

Explanation

Psychotherapy notes receive heightened protection and generally require a separate authorization even when other PHI could be used or disclosed without one. Limited exceptions exist, such as for oversight or to defend legal actions.

Question 36Information Governance in Healthcare

A patient asks a hospital to restrict disclosure of their PHI to a health plan for a service the patient paid for in full out of pocket. What is the covered entity's obligation?

  1. It may refuse because restrictions are always discretionary
  2. It must agree to the restriction for that service Correct answer.
  3. It must obtain a court order before applying the restriction
  4. It may apply the restriction only after the plan requests it

Explanation

When a patient pays in full out of pocket for an item or service, the covered entity must accommodate a request to restrict disclosure to a health plan for that item or service. Other restriction requests remain discretionary.

Question 37Information Governance in Healthcare

Which element is generally required for a valid HIPAA authorization for disclosure of PHI?

  1. A notarized signature witnessed by a compliance officer
  2. A statement that the covered entity may revoke the patient's right to access
  3. A waiver of all future privacy rights signed by the patient
  4. A description of the information to be disclosed and the recipient Correct answer.

Explanation

A valid authorization must identify the information, the recipients, the purpose, the expiration, and the patient's revocation rights, among other core elements. It cannot require the patient to waive rights or access.

Question 38Information Governance in Healthcare

A health system discovers that a laptop containing unencrypted PHI was stolen from an employee's car. Under the HITECH breach notification rule, what must the entity assess first?

  1. Whether the media should be contacted before HHS
  2. Whether the incident constitutes a breach through a risk assessment Correct answer.
  3. Whether the employee should be terminated before notification
  4. Whether the laptop cost exceeds the entity's capital threshold

Explanation

The entity must perform a risk assessment considering the nature and extent of PHI, the unauthorized recipient, whether the information was actually acquired or viewed, and the extent of risk mitigation. Notification duties follow from that determination.

Question 39Information Governance in Healthcare

A breach affecting 600 individuals in a single state must be reported to which parties under the HITECH breach notification rule?

  1. Only HHS through the annual log submission
  2. Only the affected individuals and the state attorney general
  3. Only the affected individuals, with no regulator notice
  4. Affected individuals, HHS, and prominent media outlets Correct answer.

Explanation

Breaches affecting 500 or more individuals require notice to affected individuals, notice to HHS, and notice to prominent media outlets in the affected state or jurisdiction without unreasonable delay and no later than 60 days after discovery.

Question 40Information Governance in Healthcare

Which principle of information governance addresses assigning a named individual accountable for the accuracy and protection of a specific data set?

  1. Data de-identification
  2. Data retention
  3. Data stewardship Correct answer.
  4. Data minimization

Explanation

Data stewardship assigns accountability to a named owner or steward responsible for the quality, use, and protection of a defined data domain. Minimization limits collection, de-identification removes identifiers, and retention governs how long data is kept.

Question 41Information Governance in Healthcare

A hospital is designing a records retention schedule. Which consideration most directly governs how long clinical records must be kept?

  1. The average patient lifespan in the local population
  2. The vendor's default storage contract length
  3. Applicable legal, regulatory, and accreditation requirements Correct answer.
  4. The maximum period permitted by the state medical board

Explanation

Retention periods are driven by a combination of state medical record laws, federal requirements, payer contracts, and accreditation standards, and the entity must retain records for the longest applicable period. Vendor defaults and population statistics do not establish legal minimums.

Question 42Information Governance in Healthcare

Which practice best supports the principle of minimum necessary when a nurse accesses a patient record?

  1. Granting the nurse enterprise-wide access to all patient records
  2. Auditing the nurse's access only after a complaint is filed
  3. Requiring the nurse to sign a new authorization each shift
  4. Limiting access to information needed for the nurse's current care duties Correct answer.

Explanation

Minimum necessary means limiting use, disclosure, and access to the least amount of PHI needed for the task. Role-based access aligned to current duties implements this principle operationally.

Question 43Information Governance in Healthcare

An analyst needs to share a data set for quality reporting while reducing re-identification risk. Which approach aligns with the HIPAA de-identification standard?

  1. Applying either the safe harbor method or expert determination Correct answer.
  2. Removing only the patient's name and address
  3. Replacing identifiers with a reversible mapping stored with the data
  4. Encrypting the data set and sharing the decryption key

Explanation

HIPAA recognizes two de-identification pathways: removal of the 18 specified identifiers under safe harbor, or a qualified expert's determination that re-identification risk is very small. Partial removal or reversible mappings do not meet the standard.

Question 44Information Governance in Healthcare

A covered entity is evaluating a cloud vendor that will store ePHI. Which governance action is most appropriate before signing?

  1. Delegate all security responsibility to the vendor by contract
  2. Rely on the vendor's public security webpage as due diligence
  3. Execute a business associate agreement and assess the vendor's controls Correct answer.
  4. Assume the vendor is compliant because it holds a SOC 2 report

Explanation

The covered entity must obtain satisfactory assurances, typically through a business associate agreement, and should perform its own risk-based due diligence on the vendor's safeguards. A certification or report supports but does not replace the agreement and assessment.

Question 45Information Governance in Healthcare

Which activity is a core function of a healthcare organization's information governance program rather than an IT operations task?

  1. Approving the enterprise data policy and assigning data owners Correct answer.
  2. Racking new storage arrays in the data center
  3. Resetting user passwords at the service desk
  4. Patching servers on the nightly maintenance window

Explanation

Information governance sets decision rights, policies, and accountability for data across the organization, including policy approval and assignment of data ownership. Patching, password resets, and hardware installation are operational IT tasks.

Question 46Information Governance in Healthcare

A patient exercises the right to amend their record, and the covered entity disagrees with the requested change. What is the appropriate action?

  1. Forward the request to the health plan for a final decision
  2. Deny the request and document the denial with the patient's statement Correct answer.
  3. Ignore the request because amendment rights are discretionary
  4. Delete the original record and replace it with the patient's version

Explanation

When a covered entity denies an amendment, it must provide a written denial and allow the patient to submit a statement of disagreement that is retained and included in future disclosures. The original record is not destroyed.

Question 47Information Governance in Healthcare

A privacy officer must determine whether an incidental disclosure during a hallway conversation is a violation. Which factor is most relevant to the analysis?

  1. Whether the conversation lasted more than thirty seconds
  2. Whether the staff member had signed an annual attestation
  3. Whether the disclosure was an incidental use permitted under reasonable safeguards Correct answer.
  4. Whether the patient was wearing an identification bracelet

Explanation

The Privacy Rule permits incidental uses and disclosures that occur as a byproduct of an otherwise permitted use when reasonable safeguards are in place. The analysis focuses on safeguards and intent, not on duration or attire.

Question 48Information Governance in Healthcare

Which law specifically requires financial institutions and certain health care entities to safeguard customer information and includes an exception allowing sharing of health information for treatment?

  1. The Clinical Laboratory Improvement Amendments
  2. The Federal Food, Drug, and Cosmetic Act
  3. The Sarbanes-Oxley Act
  4. The Gramm-Leach-Bliley Act Correct answer.

Explanation

The Gramm-Leach-Bliley Act imposes privacy and safeguard obligations on financial institutions, and its implementing rules include an exception permitting sharing of health information for treatment and certain other purposes. The other statutes address corporate accounting, food and drug regulation, and laboratory standards.

Question 49Information Governance in Healthcare

A covered entity receives a subpoena for a patient's records in a civil lawsuit but no court order or patient authorization accompanies it. What must the entity generally do?

  1. Disclose the records immediately because a subpoena is a court order
  2. Refuse all disclosures in civil litigation without exception
  3. Obtain satisfactory assurances that the requesting party has notified the patient Correct answer.
  4. Send the records to the opposing attorney for redaction first

Explanation

For subpoenas and discovery requests without a court order, the covered entity must receive satisfactory assurances that the requesting party has made reasonable efforts to notify the individual or that a protective order exists. A subpoena alone is not equivalent to a court order.

Question 50Information Governance in Healthcare

Which statement best describes the role of a designated privacy officer under HIPAA?

  1. The officer's duties are limited to responding to patient complaints
  2. The officer must be a licensed attorney employed by the entity
  3. The officer may only be appointed after an HHS investigation
  4. The officer is responsible for developing and implementing privacy policies Correct answer.

Explanation

A covered entity must designate a privacy official responsible for developing and implementing privacy policies and procedures and for receiving complaints. The role is not restricted to attorneys and covers more than complaint handling.