HIPAA HIPAA Certifications HIO-201 Questions & Answers

• Question 61:

  Select the best statement regarding de-identified information (DII),

  A. De-identified information is IIHI that has had all individually (patient) identifiable information removed.

  B. DII may be used only with the authorization of the individual.

  C. DII remains PHI.

  D. The only approved method of de-identification is to have a person with "appropriate knowledge and experience" tie-identify the IIHI.

  E. All PHI use and disclosure requirements do not apply to re-identified DII.

  Correct Answer: A

• Question 62:

  Formal, documented instructions for reporting security breaches are referred to as:

  A. Business Associate Contract

  B. Response and Reporting

  C. Emergency Access Procedure

  D. Sanction policy

  E. Risk Management

  Correct Answer: B

• Question 63:

  HIPAA establishes a civil monetary penalty for violation of the Administrative Simplification provisions. The penalty may not be more than.

  A. $1 000000 per person per violation of a single standard for a calendar year

  B. $10 per person per violation of a single standard for a calendar year.

  C. $25000 per person per violation of a single standard for a calendar year.

  D. $2,500 per person per violation of a single standard for a calendar year

  E. $1000 per person per violation of a single standard for a calendar year

  Correct Answer: C

• Question 64:

  Workstation Use falls under which Security Rule area?

  A. Person or Entity Authentication

  B. Technical Safeguards

  C. Administrative Safeguards

  D. Physical Safeguards

  E. Transmission Security

  Correct Answer: D

• Question 65:

  Establishing policies and procedures for responding to an emergency or other occurrence that damages systems is an example of

  A. Security Awareness and Training

  B. Security Incident Procedure

  C. Information Access Management

  D. Security Management Process

  E. Contingency Plan

  Correct Answer: E

• Question 66:

  A key date in the transaction rule timeline is:

  A. October 16, 2003 -- small health plans to begin testing without ASCA extension

  B. October 16, 2004 -- full compliance deadline for small health plans

  C. April 16, 2004 -- small health plans to begin testing with ASCA extension

  D. April 16, 2003 - deadline to begin testing with ASCA extension

  E. April 14, 2003; deadline to begin testing with the ASCA extension.

  Correct Answer: D

• Question 67:

  Assigning a name and/or number for identifying and tracking users is required by which security rule implementation specification?

  A. Access Authentication

  B. Integrity Controls

  C. Authorization and/or Supervision

  D. Data Authentication

  E. Unique User Identification

  Correct Answer: E

• Question 68:

  Conducting an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic PHI is:

  A. Risk Analysis

  B. Risk Management

  C. Access Establishment and Modification

  D. Isolating Health care Clearinghouse Function

  E. Information System Activity Review

  Correct Answer: A

• Question 69:

  This rule facilitates information exchange, such as Benefits Inquiry, between providers and payers:

  A. The HHS rule

  B. The Transaction rule

  C. The Privacy rule

  D. The Security rule

  E. The Electronic Signature rule

  Correct Answer: B

• Question 70:

  ANSI Xl 2 specifies the use of a (an):

  A. Simple flat file structure for transactions.

  B. Envelope structure for transactions.

  C. Employer identifier.

  D. Health plan identifier.

  E. Provider identifier.

  Correct Answer: B