HIO-201 Practice Exam Questions with Answers Certified HIPAA Professional Certification

De-identified information is IIHI that has had all individually (patient) identifiable information removed.

Oil may be used only with the authorization of the individual.

Oil remains PHI.

The only approved method of de-id entitle at ion is to have a person with “appropriate knowledge and experience” de-identify the IIHI.

All PHI use and disclosure requirements do not apply to re-identified DII.

Accident Report.

First Report of Injury.

Health Care Claim.

Health Care Claim Payment/Advice.

Premium Payment.

Risk Management

Protection from Malicious Software

Facility Security Plan

Response and Reporting

Emergency Access Procedure

Security rule.

Privacy rule.

Covered entity rule.

Electronic Transactions and Code Sets rule.

Electronic Signature Rule.

An organized health care arrangement is a clinically integrated setting in which patients receive care from multiple providers.

Independent providers participating in an organized health care arrangement are business associates of each other.

An example of an OHCA is a nurse employed in a physician's office.

An example of an OHCA is a laboratory attached to a physician's office.

An example of an OHCA is a health insurance company and its affiliated life insurancecompany.

Contingency Plan

Facility Security Plan

Emergency Mode Operation Plan

Accountability

Device and Media Controls

Patient's country of birth

Patient's pet name

Patient's weight

Patient's address

Patient's date of birth

"Use" refers to the release, transfer, or divulging of IIHI between various covered entities

"Use" refers to adding, modifying and deleting the PHI by other covered entities.

"Use" refers to utilizing, examining, or analyzing IIHI within the covered entity

"Use" refers to the movement of de-identified information within an organization.

"Use" refers to the movement of information outside the entity holding the information

Country of birth.

Telephone number.

Information on past 3 employers.

Patient credit reports.

Smart card-based digital signatures.

Verbally request 3 consent and offer a copy of the Notice of Privacy Practices.

Verbally request specific authorization for the PHI.

Do nothing more.

Obtain the signature of the patient on their Notice of Privacy Practices.

Not respond to the request without an authorization from the primary physician.

Is another name for the Security Ruling.

Requires the use of biometrics for access to records.

Is electronically stored information about an individual's health status and health care.

Identifies all hospitals and health care organizations.

Requires a PKI for the provider and the patient.

Sanction Policy

access Authorization

Facility Security Plan

Termination Procedures

Unique User Identification

Risk Analysis

Risk Management

Access Establishment and Modification

Isolating Health care Clearinghouse Function

Information System Activity Review

Media Re-use

Termination Procedures

Risk Management

Maintenance Records

Disposal

Their professional judgment and standards.

The policies set by the security rule for the protection of the information.

Specific guidelines set by WEDI.

Measures that are expedient and reduce costs.

The information for research and marketing purposes only.

Security Awareness Training

Workforce Security

Facility Access Controls

Workstation Use

Workstation Security

The Secretary is required by statue to Impose penalties of at least $100 per violation on any person or entity that fails to comply with a standard except that the total amount imposed on any one person in each calendar year may not exceed $1,000.000 for violations of one requirement

Health plans are required to accept all standard transactions.

Health plans may not require providers to make changes or additions to standard transactions

Health plans may not refuse or delay payment of standard transactions.

If additional information is added to a standard transaction it must not modify the definition, condition, intent, or use of a data element

The CPT-4 code set is maintained by the American Medical Association (AMA).

A covered entity must use the applicable medical code set that is valid at the time the health care is delivered.

The National Provider Identifier (NPI) will be assigned by the National Provider System (NPS).

The Centers for Medicare and Medicaid Services is responsible for updating the HCPCScode set.

The National Provider Identifier (NPI) will be assigned to health plans.

Situations where the marketing is for a drug or treatment could improve the health of that individual.

Situations where the patient has already signed the covered entity's Notice of Privacy Practices.

A face-to-face encounter with the sales person of a company that provides drug samples

A communication involving a promotional gift of nominal value.

The situation where the patient has signed the Notice of Privacy Practices of the marketer.