HIPAA HIPAA Certifications HIO-201 Questions & Answers

• Question 111:

  The applicable methods for HIPAA-related EDI transactions are:

  A. Remote and enterprise.

  B. Claim status and remittance advice.

  C. Subscriber and payer.

  D. Batch and real-time.

  E. HCFA-1500 and 837.

  Correct Answer: D

• Question 112:

  In addition to code sets, HIPAA transactions also contain:

  A. Security information such as a fingerprint.

  B. Privacy information.

  C. Information on all business associates,

  D. Information on all health care clearinghouses.

  E. Identifiers.

  Correct Answer: E

• Question 113:

  Select the correct statement regarding the administrative requirements of The HIPAA privacy rule.

  A. A covered entity must designate, and document, a privacy official, security officer and a HIPAA compliance officer

  B. A covered entity must designate, and document, the same person to be both privacy official and as the contact person responsible for receiving complaints and providing further information about the notice required by the regulations.

  C. A covered entity must implement and maintain written or electronic policies and procedures with respect to PHI that are designed to comply with HIPAA standards, implementation specifications and other requirements.

  D. A covered entity must train, and document the training of. at least one member of its workforce on the policies and procedures with regard to PHI as necessary and appropriate for them to carry out their function within the covered entity no later than the privacy rule compliance date.

  E. A covered entity must retain the document required by the regulations for a period often years from the time of it's creation or the time it was last in effect, which ever is later

  Correct Answer: C

• Question 114:

  To comply with the Privacy Rule, a valid Notice of Privacy Practices:

  A. Is required for all Chain of Trust Agreements.

  B. Must allow for the patient's written acknowledgement of receipt.

  C. Must always be signed by the patient.

  D. Must be signed in order for the patient's name to be sold to a mailing list organization.

  E. Is not required if an authorization is being developed.

  Correct Answer: B

• Question 115:

  Security to protect information assets is generally defined as having:

  A. Controls

  B. PRI

  C. Biometrics

  D. VPN technology

  E. Host-based intrusion detection

  Correct Answer: A

• Question 116:

  One characteristic of the Notice of Privacy Practices is:

  A. It must be written in plain, simple language.

  B. It must explicitly describe all uses of PHI.

  C. A description about the usage of hidden security cameras for tracking patient movements for implementing privacy.

  D. A description of the duties of the individual.

  E. A statement that the individual must abide by the terms of the Notice.

  Correct Answer: A

• Question 117:

  Physical safeguards using media controls do not include procedures to:

  A. Control access to tapes, floppies, and re-writeable CDs.

  B. Track the access of record able media.

  C. Dispose of storage devices,

  D. Backup copies of health information.

  E. Prohibit alteration of health information.

  Correct Answer: E

• Question 118:

  When limiting protected health information (PHI) to the minimum necessary for a use or disclosure, a covered entity can use:

  A. Their professional judgment and standards,

  B. The policies set by the security rule for the protection of the information,

  C. Specific guidelines set by WEDI.

  D. Measures that are expedient and reduce costs.

  E. The information for research and marketing purposes only.

  Correct Answer: A

• Question 119:

  This Security Standard addresses the proper functions to be performed on a specific workstation as well as the physical attributes of its surroundings,

  A. information Access Management

  B. Workstation Security

  C. Access Control

  D. Facility Access Controls

  E. Workstation Use

  Correct Answer: E

• Question 120:

  Select the correct statement regarding the "Minimum Necessary" standard in the HIPAA regulations.

  A. In some circumstances a covered entity is permitted, but not required, to rely on the judgment of the party requesting the disclosure as to the minimum amount of information necessary for the intended purpose. Some examples of these requesting parties are: another covered entity or a public official.

  B. The privacy rule prohibits use, disclosure, or requests for an entire medical record,

  C. Non-Covered entities need to redesign their facility to meet the requirement for minimum necessary uses.

  D. The minimum necessary standard requires covered entities to prohibit maintenance of medical charts at bedside and to require that X-ray light boards be totally isolated.

  E. If there is a request for more than the minimum necessary PHI, the privacy rule requires a covered entity to deny the disclosure of information after recording the event in the individual's case file.

  Correct Answer: A