Introduction to the Fundamentals of Law for Health Information and Information Management Practice Test

These questions are part of the practice quiz. Start practicing

• The statement 'Although the US Constitution does not expressly grant the right of privacy, it provides safeguards against government intrusion' is true or false?
• What term describes the information detailing the contents of a health record, including what constitutes a legal health record?
• What is the appropriate course of action when a data breach occurs in a health information management context?
• How do privacy and security roles align with the principle of least privilege in access control?
• Describe HIPAA breach notification requirements, including who must be notified and by when.
• Which statement about data use agreements (DUAs) is correct for research data sharing?
• Which statement best describes the relationship between HIPAA and HITECH?
• What constitutes 'willful neglect' under HIPAA civil penalties?
• In health IT, what is the purpose of tamper-evident logs?
• What term describes the health record as the legal record created in the normal course of business of an organization or healthcare provider?
• Which statement about confidentiality best describes its scope?
• Which option best describes the purpose of a compliance program in HIM?
• Which term is defined as an electronic record of health-related information on an individual that conforms to nationally recognized interoperability standards and can be drawn from multiple sources while being managed by the individual?
• Which term describes a record that uses both paper and electronic media?
• What is a HIPAA Security Rule risk analysis and what should it address?
• What is the difference between PHI and ePHI, and what technologies fall under ePHI?
• Which term describes an electronic health record that can be shared across multiple healthcare organizations?
• In health information management, which option best describes the primary purpose of a compliance program for HIM staff?
• Which term describes the right to view or access health information held by a provider under privacy laws?
• According to ASTM E31 Health Informatics, security is defined from how many perspectives?
• How does the minimum necessary standard apply to disclosures to a business associate?
• What must a Business Associate Agreement specify?
• The custodian's duties include supervising inspection and copying or duplication of records and testifying about the record's authenticity. This statement is:
• Which term refers to an electronic health record that can be created, managed, and consulted across more than one healthcare organization?
• How do PHI, Limited Data Set, and De-identified data differ in terms of identifiers and usage?
• Which federal law provides privacy protections for health information?
• What term describes the risk that electronic data may become unreadable when moved away from its original environment?
• Compare de-identification with anonymization in the HIPAA context.
• Which term describes electronic documents that include information about the document or file that can be used to store and retrieve later?
• Who typically owns medical records, and what rights do patients have?
• Electronic documents are easily stored in multiple locations such as hard drives, servers, or portable devices. This describes which concept?
• The integrity concept in information security includes which elements?
• Which statement correctly differentiates an EMR from an EHR?
• Which statement best describes privileged communication in healthcare?
• Which of the following is an example of a technical safeguard under the HIPAA Security Rule?
• Identify the three HIPAA Security Rule safeguard categories and give an example of each.
• What change did HITECH make regarding HIPAA’s scope?
• In telemedicine privacy, which requirement pertains specifically to the patient's environment?
• Under HIPAA, which term defines information created or received by a health care provider related to a patient’s health?
• What is data stewardship in health information management?
• Which statement best defines PHI under HIPAA?
• Under HIPAA, how may patient access rights interact with family disclosures?
• What is the difference between a data controller and a data processor in privacy law contexts?
• Which statement best describes a Limited Data Set in HIPAA terms?
• What term describes tools that allow patients to electronically access their personal health record and perform functions such as scheduling and messaging with their provider?
• Privileged communication is usually delineated by which level of law?
• Who owns the health record?
• Which statement most accurately reflects the function of a compliance program for HIM staff?
• How can patients impose restrictions on disclosures, and in what situation should a covered entity consider such restrictions?
• What genetic information protections does HIPAA and GINA provide?
• Which statement best describes the function of a compliance program for HIM staff?
• Which statement about HIPAA timelines is correct?
• Which statement accurately describes Limited Data Set and Data Use Agreements?
• Which option best describes the purpose of a compliance program in HIM?
• Which statement describes privacy as understood in legal and social contexts, referencing Warren and Brandeis’ characterization?
• Which type of record is typically stored within a single organization and may not be designed for wide sharing?
• How can researchers obtain PHI for approved studies under HIPAA?
• Stewardship is described as an organization-wide framework for managing information throughout its lifecycle and supporting regulatory, legal, risk, and environmental requirements. This description defines:
• Which of the following is a primary purpose of data security?
• The Joint Commission definition of security reflects safeguards to prevent unauthorized access, use, disclosure, modification, or destruction of information or interference with system operations in an information system. This concept is called what?
• Name three purposes for which PHI can be used or disclosed without patient authorization under the Privacy Rule.
• The Health Information Technology for Economic and Clinical Health Act (HITECH) is part of which larger act?
• Which term describes that electronic information can be more easily modified than paper information?
• Which statement best describes a health information professional's duty regarding confidentiality?
• Electronic documents contain which of the following that provides data about the document for retrieval?
• Which description accurately reflects the role of a compliance program for HIM personnel?
• What is the legal term used to define the protection of health information in a patient-provider relationship?
• What is the primary focus of a HIPAA Security Rule risk analysis?
• Under the HIPAA Security Rule, how is encryption treated?
• An official custodian is required by both federal and state rules of evidence to permit health records to be entered as what type of records in legal proceedings?
• The Joint Commission defines privacy as the individual's right to what?
• Which statement about HIPAA authorizations for research is correct?
• Which statement best describes the function of a compliance program for HIM staff?
• The confidentiality concept means preserving authorized restrictions on access and disclosure, including personal privacy and proprietary information. Which option best captures confidentiality?
• According to AHIMA, a ____________ comprises individually identifiable data, in any medium, that is collected, processed, stored, displayed, and used by healthcare professionals.
• In privacy by design, what is a common default privacy setting?
• Which de-identification method under HIPAA involves an expert's determination that the risk of re-identification is very small?
• Which description accurately reflects the role of a compliance program for HIM personnel?
• What is the function of a compliance program for HIM staff?
• What term describes the ability to exchange electronic health information across organizations using nationally recognized interoperability standards?
• What is the legal term used to describe the physical and electronic protection of health information?
• Privacy protection related to health information has been established in all but which one of the following ways?
• What is the function of a compliance program for HIM staff?
• Which type of health record is designed to contain data drawn from multiple organizations?
• What is the purpose of the minimum necessary standard for family disclosures in a hospital setting?
• Who enforces HIPAA Privacy and Security Rules and what penalties may apply for noncompliance?
• Which statement best describes private law?
• What is included in an accounting of disclosures, and which disclosures are typically exempt?
• What actions constitute a typical organizational response to privacy violations by staff in HIM?
• Which legal concept underpins the confidentiality of physician-patient communications that are intended to be confidential?
• What is the function of a compliance program for HIM staff?
• What impact did HITECH have on breach notification and meaningful use?
• Which description accurately reflects the role of a compliance program for HIM personnel?
• Which term describes extending custodial duties to ensure integrity and security within electronic information and records management?
• Which agency enforces HIPAA compliance and can impose penalties?
• What term is commonly used for the individual within an organization responsible for protecting health information in conjunction with the court system?
• How does a Limited Data Set differ from fully de-identified data for research, and what agreement is required?
• Which of the following is NOT listed as a secondary use of health information?
• Under HIPAA, when can PHI be disclosed to law enforcement without patient authorization?
• Describe what a Business Associate Agreement (BAA) is and why it is required.
• Data security is the result of data protection measures and safeguards data from unauthorized access and from unauthorized or accidental alteration. Which term describes this concept?
• A compliance program for HIM personnel is designed to do which of the following?
• Which term explains why it is much more difficult to dispose of electronic documents than paper documents?
• Who described privacy as a social value in 1890, coining the phrase often associated with it?
• Which of the following best describes the purpose of security in health information systems?
• Which statement best contrasts consent and authorization under HIPAA?
• HIPAA and HITECH are two of more than ______ federal laws addressing privacy, confidentiality, and security protections.
• How do cross-border data transfers such as EU-US data transfers get regulated?
• In the context of HITECH, what does 'meaningful use' aim to achieve?
• Under HIPAA Privacy Rule, which of the following is not a permissible use or disclosure of PHI without patient authorization?
• According to ASTM EM31 Subcommittee on Health Informatics, confidentiality is defined as which of the following?
• What are break-the-glass procedures, and why are they important?
• The totality of safeguards including hardware, software, personnel policies, information practice policies, disaster preparedness, and oversight is called what?
• What is the HIPAA Privacy Rule's Right of Access?
• The Joint Commission accredits more than how many healthcare organizations and programs in the United States?
• What does the HIPAA Privacy Rule's minimum necessary standard require, and when does it apply?
• Which statement best describes public law?
• What is the role of a Privacy Impact Assessment (PIA/DPIA) in health IT projects?
• How might GDPR affect a U.S. hospital handling EU patient PHI?
• Stewardship is a component of which framework?
• Which term describes 'providing timely and reliable access to information' as part of the information security triad?
• What was the primary goal of the Health Information Technology for Economic and Clinical Health Act (HITECH) of 2009?
• The health record custodian is defined as the individual responsible for the operational functions related to the development and maintenance of records.
• In breach reporting, what triggers media notification?
• Which concept describes that electronic data may not be readable once moved from its environment?
• What is the purpose of maintaining audit trails and logs in health IT systems?
• During a data breach, what is the first critical action to take?
• Which option best describes the purpose of a compliance program in HIM?
• Which mechanism ensures that EU-US data transfers maintain sufficient privacy protection?
• When did many HITECH requirements take effect and when were the remaining provisions finalized?
• The result of sharing private thoughts with someone else in confidence is which concept?
• Which privacy considerations apply to telemedicine practice?
• When someone is identified as an information steward, the individual is responsible for what activities?
• Which term best describes the physical and electronic protection of health information?
• Define privacy by design and identify two examples in health IT.
• Which term best describes the protection of data from unauthorized disclosure or alteration, as used in health information management?
• What are the four primary sources of law that govern health information management activities in the United States?
• What major goal did HITECH promote in health IT?
• The Joint Commission's accreditation scope includes nursing care centers. Which of the following is listed as an area accredited by the Joint Commission?
• Which item is NOT typically included in a HIPAA risk assessment?
• Which term describes an electronic record of health information stored within a single healthcare organization?
• What are common record retention guidelines for health information in HIM?
• Under Safe Harbor, how many identifiers must be removed to de-identify PHI?
• The Joint Commission accredits which of the following areas?
• Which HIPAA rule addresses safeguarding electronic PHI?
• How does informed consent for research differ from standard clinical consent in HIM contexts?
• What is a data breach and what are the typical steps for a breach response?
• When an organization engages in enterprise information system (EIM), this effort is best described by which term?
• How do privacy and confidentiality differ in health information management?
• What is the primary use of health information?
• Which entities are subject to HIPAA Privacy and Security Rules?
• Which of the following is an example of a private law issue in health information?
• Under HIPAA, which statement correctly describes a patient's right to amend PHI?
• Which is NOT a typical outcome of a Privacy Impact Assessment (PIA) for health IT projects?
• In health information management, who holds the right to control the information within the health record according to federal and state laws?
• The 'custodian of health records' refers to the individual within an organization who is responsible for which action(s)?
• PHI stands for Protected Health Information. Which of the following is an example of PHI?
• What is the function of a compliance program for HIM staff?
• What role does OCR play in HIPAA compliance enforcement?
• Which form of a health record serves as the organization's legal business record and as evidence in lawsuits or other legal actions?
• What are the public health reporting provisions under HIPAA?
• Under what circumstance can IRB waive informed consent for research involving PHI?
• What does the acronym HIE stand for in health information technology?
• What is an Accounting of Disclosures and when must it be provided?
• Which scenario illustrates public law in healthcare?
• Traditionally, ownership of the physical health record has been granted to whom?
• What is the primary goal of data governance in health information management?
• Since 2013, there has been a trend in hospitals regarding patients' ability to electronically view, download, and transmit health information. Which statement is accurate?
• Which statement reflects a principle closely associated with privacy rights under HIPAA?
• What measures help health IT systems ensure data integrity?
• Privacy protection for health information has been established through multiple means, including HIPAA and the HITECH provisions of ARRA. True or False?
• What does it mean to de-identify PHI under HIPAA, and what are Safe Harbor and Expert Determination methods?
• Which entity enforces health information privacy concerns in many jurisdictions?
• Information governance is described as which of the following?
• Which type of law governs government actions and relationships between government and individuals?
• Which organization provides the definition of privacy used by the Health Informatics Subcommittee under ASTM?
• Which type of law addresses contracts between two entities?
• What describes break-the-glass access in a health information privacy context?