SESKStuff Everyone Should Know

Games · Test prep

Stuff Every Healthcare Worker Should Know

HIPAA training prep: the Privacy, Security and Breach Notification Rules, and what to do on the job.

Start Stuff Every Healthcare Worker Should Know ⚡ Today's sprint

Print the first 50 cards (free)Get the whole test as a printable PDF: $3 (pre-order)

Free to start, no sign-up. 111 cards so far. One Knowledge Score and day streak across all your courses.

Try 3 cards

  1. Does HIPAA protect patient information that is spoken out loud, or only paper and computer records?
    Show the answer

    Spoken, paper and electronic information. Protected health information (PHI) is identifiable health information in any form or medium. A comment at the nurses' station is protected just like a chart or a database.

  2. A hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?
    Show the answer

    No, employment records held as employer are excluded. HIPAA's definition of PHI leaves out employment records a covered entity holds in its role as employer. Dana's records as a patient would still be PHI, and other workplace laws may still protect the HR file.

  3. For how long after a person dies must a covered entity keep protecting that person's health information?
    Show the answer

    50 years. The Privacy Rule keeps protecting a deceased person's PHI for 50 years after death. After that, the information no longer counts as PHI.

All 111 practice questions

Each one has the answer, why it's right, and the official sources. Or play them as a game and track what you've learned.

Show all 111 questions
  1. Does HIPAA protect patient information that is spoken out loud, or only paper and computer records?
  2. A hospital's HR office keeps Dana's pre-hire physical in Dana's personnel file, as the employer. Is that file PHI?
  3. For how long after a person dies must a covered entity keep protecting that person's health information?
  4. How many identifiers must be removed under HIPAA's Safe Harbor method to de-identify health data?
  5. Besides Safe Harbor, what is HIPAA's other way to de-identify health data?
  6. Under Safe Harbor, how much of a patient's ZIP code may stay in de-identified data?
  7. Under Safe Harbor, which part of a patient's admission date may stay in de-identified data?
  8. In Safe Harbor de-identified data, how must a 93-year-old patient's age appear?
  9. Which of these is one of HIPAA's 18 Safe Harbor identifiers?
  10. Under Safe Harbor, whose identifiers must be removed besides the patient's own?
  11. Which three kinds of organizations are HIPAA covered entities?
  12. A clinic hires an outside company to handle its insurance billing using patient records. What is that company under HIPAA?
  13. Is an unpaid hospital volunteer part of the workforce under HIPAA?
  14. A clinic sends records to a specialist who will treat the patient. Is the specialist the clinic's business associate?
  15. A business associate hires a subcontractor that will handle PHI. Who must get the subcontractor's written assurances?
  16. When a business associate contract ends, what must happen to the PHI the business associate still holds, if feasible?
  17. What must a clinic have before letting a cloud company store its patient records?
  18. A billing clerk needs a patient's insurance ID. How much of the patient's chart should the clerk look at?
  19. Does the minimum necessary rule limit what a nurse shares with a doctor who is treating the same patient?
  20. Does a hospital need a patient's signed authorization to use PHI for treatment, payment or health care operations?
  21. A hospital sends a claim to a patient's insurer to get paid. Which HIPAA category is that?
  22. A hospital uses real charts to review how well its nurses perform. Which HIPAA category is that?
  23. What does a covered entity generally need before disclosing a patient's psychotherapy notes?
  24. Which of these is NOT part of a patient's psychotherapy notes under HIPAA?
  25. A drug company pays a clinic to mail its patients ads for a new product. What does the clinic need?
  26. Is a pharmacy's refill reminder about a drug a patient is currently prescribed considered marketing under HIPAA?
  27. Can a covered entity sell patients' PHI to a data company without the patients' authorization?
  28. How can a patient take back a HIPAA authorization they signed?
  29. Can a clinic refuse to treat a patient who won't sign an authorization for marketing?
  30. A patient is awake and alert with a friend in the room. Before discussing care in front of the friend, staff should:
  31. Can a pharmacy let a patient's neighbor pick up the patient's filled prescription?
  32. Which hospital directory detail may go only to clergy, not to visitors who ask for a patient by name?
  33. How long does a covered entity generally have to act on a patient's request for copies of their records?
  34. A patient asks for an electronic copy of records the clinic keeps electronically. What must the clinic do?
  35. What may a provider charge a patient for a copy of their own records?
  36. How long does a covered entity have to act on a patient's request to amend their record?
  37. If a covered entity denies a patient's request to amend their record, what may the patient do?
  38. A patient asks for an accounting of disclosures of their PHI. How far back can it cover?
  39. How often must a covered entity give a patient an accounting of disclosures for free?
  40. A patient pays in full out of pocket and asks that the visit not be shared with their health plan. Must the provider agree?
  41. A patient asks the clinic to call a cell phone instead of the home phone. Can the clinic demand a reason?
  42. When must a provider with a direct treatment relationship give a patient its Notice of Privacy Practices?
  43. Who usually acts as a minor child's personal representative under HIPAA?
  44. Who can act as a deceased patient's personal representative under HIPAA?
  45. May a provider refuse to treat someone as a patient's personal representative if it suspects that person of abuse?
  46. HIPAA requires a covered entity to disclose PHI in only two situations. Which pair?
  47. What is electronic protected health information, or ePHI?
  48. Who must comply with the HIPAA Security Rule?
  49. What are administrative safeguards in the HIPAA Security Rule?
  50. What are physical safeguards under the Security Rule?
  51. What are technical safeguards in HIPAA?
  52. What does the Security Rule require before choosing safeguards?
  53. After a risk analysis, what must an organization do?
  54. Who is responsible for security policies under the Security Rule?
  55. Which workers must receive HIPAA security training?
  56. What should happen if a workforce member violates security policies?
  57. Under the HIPAA Security Rule, what are "security reminders"?
  58. Under the Security Rule, how are password procedures classified?
  59. Which HIPAA security awareness topic covers phishing emails?
  60. What does the Security Rule's log-in monitoring item call for?
  61. What must a healthcare group do about security incidents?
  62. What is a contingency plan in the Security Rule?
  63. What kind of data backup plan is required under HIPAA?
  64. Which plan helps restore lost ePHI after a disaster?
  65. What does an emergency mode operation plan address?
  66. How often should contingency plans be tested?
  67. What is a facility security plan under the Security Rule?
  68. What does a workstation use policy specify?
  69. What physical safeguard protects workstations that access ePHI?
  70. How must electronic media with ePHI be disposed of?
  71. Before reusing a hard drive that held ePHI, what must happen?
  72. Which addressable safeguard tracks hardware and media movement?
  73. How can a system track who accessed ePHI?
  74. What access must be available during an emergency?
  75. What does automatic logoff do for ePHI workstations?
  76. Is encryption always required for stored ePHI?
  77. What do HIPAA audit controls require?
  78. Which addressable control helps prove ePHI was not altered?
  79. What must happen before someone accesses ePHI?
  80. Which addressable safeguard helps detect changes to ePHI sent over a network?
  81. Is encryption required for ePHI sent over a network?
  82. Which HIPAA rule covers safe disposal of paper records with PHI?
  83. How long must HIPAA security documentation be kept?
  84. How does the Security Rule treat phones that store ePHI?
  85. What does addressable mean in the HIPAA Security Rule?
  86. What documentation does the HIPAA Security Rule require?
  87. What is a HIPAA breach?
  88. Is every impermissible PHI disclosure a breach?
  89. How many factors are used in a HIPAA breach risk assessment?
  90. What is the first factor in a HIPAA breach risk assessment?
  91. Within how many days must individuals be notified of a breach?
  92. A breach affects more than 500 residents of one state. Who must be told besides the patients?
  93. How are breaches affecting fewer than 500 people reported?
  94. What provides safe harbor from HIPAA breach rules?
  95. How many tiers exist for HIPAA civil penalties?
  96. What is the maximum prison time for criminal HIPAA violations?
  97. Where do you file a HIPAA privacy complaint?
  98. Nurse Kim looks up her neighbor's chart out of curiosity. Is that allowed?
  99. Two nurses need to discuss a patient in a hospital elevator. What should they do?
  100. Is posting patient photos or stories on social media allowed?
  101. Are sign in sheets allowed in a doctors waiting room?
  102. What should you do before faxing PHI?
  103. What should you do if you suspect a breach?
  104. Can your employer punish you for filing a HIPAA complaint?
  105. When is a breach considered discovered?
  106. Who must notify patients if a business associate has a breach?
  107. What must a breach notification letter include?
  108. When is substitute notice used for breach notification?
  109. Under the Privacy Rule, which job must every covered entity give to a named person?
  110. What is the highest civil penalty tier for HIPAA violations?
  111. Leah gets an email asking her to log in to a strange link to keep her account. What should she do?