Know Your PHI
Which of the following is considered Protected Health Information (PHI) under HIPAA guidelines?
A) A patient's medical diagnosis and treatment plan
B) A patient's favorite color
C) The current weather forecast
D) A restaurant recommendation
A) A patient's medical diagnosis and treatment plan
Which of the core HIPAA regulations primarily governs the permitted uses and disclosures of Protected Health Information (PHI) and outlines patients' rights regarding their own medical records?
The HIPAA Privacy Rule
Under the HIPAA "Minimum Necessary" rule, what level of access to a patient's Protected Health Information (PHI) should staff members generally have?
What constitutes a "breach" under the HIPAA Breach Notification Rule, distinguishing it from a general security incident?
A) Any accidental viewing of an electronic record by a hospital employee within the same department.
B) The unauthorized acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of the data.
C) Any internal communication error that is corrected within 24 hours.
D) The lawful sharing of de-identified data with a public health agency
The unauthorized acquisition, access, use, or disclosure of unencrypted PHI that compromises the security or privacy of the data.
A nurse prints out a patient's daily schedule on a physical piece of paper, folds it, slips it into her scrub pocket to take home, and accidentally drops it in the grocery store parking lot. Is this a legal exception or a massive HIPAA violation?
A) Legal exception, because physical paper notes are exempt from HIPAA.
B) Legal exception, provided the nurse goes back to look for it within 24 hours.
C) Massive HIPAA violation involving unsecured PHI and a breach of physical safeguards.
D) Legal exception, because grocery store parking lots are considered private zones.
C) Massive HIPAA violation involving unsecured PHI and a breach of physical safeguards
What specific type of personal data element, when combined with health records, serves as a direct geographic identifier that officially transforms medical information into Protected Health Information (PHI)?
- street address
- geographic subdivision
- location markers
- phone numbers
- email addresses
Which HIPAA regulation focuses specifically on administrative, physical, and technical safeguards to protect electronic Protected Health Information (e-PHI) from unauthorized access, modification, or theft?
The HIPAA Security Rule
True or False: A nurse directly involved in a patient's active daily care is permitted to look up the medical records of a celebrity patient on another floor out of personal curiosity.
False
Under the HIPAA Enforcement Rule, what is the lowest tier of civil monetary penalties, applied when a covered entity did not know and, by exercising reasonable diligence, would not have known that the violation occurred?
Tier 1: Did Not Know
An off-duty paramedic stops by a local coffee shop and loudly complains to a colleague about how a difficult trauma patient from their morning shift refused medical treatment. No names or exact addresses are mentioned, but specific details of the unique accident are shared. Is this a legal exception or a HIPAA violation?
HIPAA violation, because discussing identifiable clinical details in a public space violates privacy rules regardless of whether names are used.
Under HIPAA, which specific type of data identifier includes a patient's date of birth, admission date, or discharge date?
A) Network IP addresses
B) Temporal / Demographic identifiers
C) Biometric voice prints
D) Vehicle license plate numbers
Temporal / Demographic identifiers
What is the name of the rule established under the HITECH Act that mandates covered entities and business associates to notify affected individuals, the Department of Health and Human Services, and sometimes the media following a breach of unsecured PHI?
The Breach Notification Rule
The Emergency Disclosure Policy
The Public Health Exemption Rule
The Record Destruction Mandate
The Breach Notification Rule
What specific workplace practice regarding physical workstation security is designed to prevent "incidental disclosures" and unauthorized viewing when a staff member steps away from a computer?
C) Locking the workstation (or activating a screen lock) immediately every time the user steps away.
What severe legal distinction separates "Reasonable Cause" from "Willful Neglect" during a federal HIPAA investigation?
A) Whether the data involved was electronic paper or physical printouts.
B) Whether the incident resulted in financial profit for the employee.
C) Conscious, intentional failure or reckless indifference to the obligation to comply with HIPAA.
D) Whether the patient filed a lawsuit within 30 days of the disclosure
C) Conscious, intentional failure or reckless indifference to the obligation to comply with HIPAA.
A hospital's IT department intentionally accesses a database containing patient records without any clinical authorization to run an automated software patch and security audit. Is this a legal exception or a HIPAA violation?
Legal exception, because authorized system administration, maintenance, and security operations require system-wide technical access.
Which of the following data elements is not considered an individual identifier, but is still heavily scrutinized when dealing with limited data sets?
Postal zip codes
Medical record numbers
Social Security numbers
Full-face photographic images
Postal zip codes
Which major federal legislation enacted in 2009 significantly strengthened HIPAA enforcement by introducing tiered civil monetary penalties for violations and expanding compliance requirements directly to business associates?
A) The Affordable Care Act
B) The Americans with Disabilities Act
C) The Electronic Signatures Act
D) The HITECH Act
The HITECH Act
When is a healthcare provider legally allowed to share a patient's PHI with a family member or friend who is accompanying the patient?
A) Never, unless the family member has a signed power of attorney on file.
B) Whenever the family member asks, because family is always trusted.
C) When the patient gives explicit permission, or when professional judgment determines—based on the circumstances—that the patient does not object and the disclosure is directly relevant to that person's involvement in the patient’s care.
D) Only after the hospital legal team reviews and approves the disclosure in writing.
C) When the patient gives explicit permission, or when professional judgment determines—based on the circumstances—that the patient does not object and the disclosure is directly relevant to that person's involvement in the patient’s care.
According to the Breach Notification Rule, what is the standard timeframe within which a covered entity must notify affected individuals and the Secretary of HHS following the discovery of a breach of unsecured PHI?
Without unreasonable delay and no later than 60 calendar days
A physician posts a photo on a popular social media app celebrating a rare, successful surgery. The patient’s face is completely cropped out of the photo, and no name is visible, but the background clearly displays a unique patient room number and an unredacted medical chart on a monitor. Is this a legal exception or a HIPAA violation?
HIPAA violation, because visible background environmental identifiers (like room numbers and open charts) can compromise patient privacy.
According to the HIPAA Privacy Rule, what specific legal status must health information undergo to be completely exempt from HIPAA protections, meaning it contains zero identifiers and cannot be traced back to an individual?
De-identified data
Often referred to collectively as the HIPAA Omnibus Rule of 2013, which major update integrated HITECH Act statutory changes by making business associates directly liable for compliance failures and tightening restrictions on the use of PHI for marketing and fundraising?
The Final Omnibus Rule
What specific legal doctrine or standard allows healthcare providers to disclose PHI without patient authorization in emergency medical situations where the patient is incapacitated or unconscious?
The Emergency Circumstances / Professional Judgment exception
Beyond civil monetary fines issued by the Office for Civil Rights (OCR), what severe criminal penalties can individuals or healthcare executives face if they knowingly obtain or disclose PHI under false pretenses or with intent to sell it?
Up to 10 years in federal prison and criminal fines of up to $250,000.
A hospital shares a patient's unencrypted medical history and direct contact information with a major commercial pharmaceutical company without the patient's authorization, because the drug manufacturer verbally promised to mail free medication samples directly to the patient's home. Is this a legal exception or a massive HIPAA violation?
Massive HIPAA violation, because selling or disclosing PHI to external commercial entities for marketing or unapproved purposes without explicit authorization is strictly illegal.