CCA Confidentiality & Privacy Practice Questions
Confidentiality & Privacy makes up 4 of every 50 questions on a Tigertest CCA practice test. Here are 10 of the 16 questions on it, each with the answer and the reason.
Updated by the Tigertest team. Weighted to the AHIMA CCA Exam Content Outline. Original questions on coding guidelines and concepts; not affiliated with AHIMA.
1. Without the patient's authorization, a hospital may send PHI to the patient's health plan for:
- A.A news story on the case
- B.Payment of the claim
- C.Employer hiring decisions
- D.A drug company's marketing
Answer: B. HIPAA permits uses and disclosures for treatment, payment and health care operations without authorization. Marketing and disclosures to an employer for its own decisions need the patient's authorization.
2. The HIPAA minimum necessary standard does NOT apply to disclosures for:
- A.Health care operations
- B.Business associate work
- C.Payment
- D.Treatment
Answer: D. Disclosures to a provider for treatment are exempt, as are disclosures to the patient and those made under an authorization. Payment, operations and business associate work must be limited to the minimum necessary.
3. Which generally requires the patient's written authorization to disclose?
- A.Psychotherapy notes
- B.Data for quality review
- C.Records sent for treatment
- D.Claims sent for payment
Answer: A. Psychotherapy notes kept separately by the therapist have special protection and generally need authorization, even for most treatment and payment uses. The other uses fall under treatment, payment and operations.
4. Before an outside coding company receives PHI to code a hospital's records, HIPAA requires:
- A.Advance notice to HHS
- B.A court order
- C.A business associate agreement
- D.Authorization for each record
Answer: C. A vendor that handles PHI on a covered entity's behalf is a business associate, and the two must sign a business associate agreement. Patients do not authorize each record for this work.
5. A patient's HIPAA right of access includes the right to:
- A.Block all payment disclosures
- B.See other patients' records
- C.Get a copy of their PHI
- D.Delete any entry they dislike
Answer: C. Patients may inspect and get copies of their PHI in the designated record set. They may ask to amend it, but the provider is not required to delete entries.
6. Which disclosure must be listed in an accounting of disclosures?
- A.A report to a public health agency
- B.A claim sent to the health plan
- C.Records sent to a doctor for treatment
- D.A release the patient authorized
Answer: A. Public health reports are among the disclosures that must be accounted for. Disclosures for treatment, payment and operations, and those made under the patient's authorization, are excluded.
7. Which document tells patients how a provider may use and disclose their PHI and what their rights are?
- A.Consent to treat
- B.Business associate agreement
- C.Authorization form
- D.Notice of Privacy Practices
Answer: D. Covered entities must give patients a Notice of Privacy Practices describing uses, disclosures and patient rights. An authorization is signed permission for one specific disclosure.
8. Unique user IDs, encryption and automatic logoff are which type of HIPAA Security Rule safeguard?
- A.Organizational
- B.Technical
- C.Administrative
- D.Physical
Answer: B. Technical safeguards control access to electronic PHI through the technology itself. Physical safeguards protect facilities and devices, and administrative safeguards cover policies, training and risk analysis.
9. After discovering a breach of unsecured PHI, a covered entity must notify affected individuals no later than:
- A.60 days after the breach
- B.60 days after discovery
- C.30 days after discovery
- D.90 days after discovery
Answer: B. The Breach Notification Rule requires notice without unreasonable delay and no later than 60 calendar days after the breach is discovered. The clock starts at discovery, not at the date the breach happened.
10. A breach affects more than 500 residents of one state. Besides individuals and HHS, the covered entity must notify:
- A.The state medical board
- B.The local police
- C.Every patient on file
- D.Prominent media outlets
Answer: D. A breach of more than 500 residents of a state or jurisdiction also requires notice to prominent media outlets serving that area. HHS must be told at the same time as the individuals.
Practice all 16 confidentiality & privacy questions, and the rest of the 200-question bank, in the free CCA training sets. Questions you miss come back until you have mastered them.
Start practicingFree to start. No account needed.