The document is a series of multiple choice questions that test knowledge of HIPAA regulations. Some key points covered include: - Employees who work from home and access protected health information must implement appropriate safeguards on their home computers like automatic log off. - Covered entities must assign unique usernames and passwords to each authorized user and cannot use shared credentials. - Healthcare providers can report crimes that occur on their premises like providing false identification to law enforcement without violating HIPAA. - HIPAA requires medical records be retained for 6 years but does not specify retention for all records, just those related to privacy rights.

2. Test your HIPAA Knowledge.
http://gettinslaw.com/hipaa/category/hipaa/pop-quiz/

3. I use my home computer to do work at home. Do I have to configure my home computer to automatically logoff
during periods of inactivity?
a. No. HIPAA only governs covered entities and does not extend to requirements to personal computers.
b. Yes. Covered entities that allow employees to telecommute or work out of home-based offices, and
have access to e-PHI, must implement appropriate safeguards to protect the organization’s data. The automatic
logoff implementation specification is addressable, and must therefore be implemented if, after an assessment,
the entity has determined that the specification is a reasonable and appropriate safeguard in its environment. If
the entity decides that the logoff implementation specification is not reasonable and appropriate, it must
document that determination and implement an equivalent alternative measure, presuming that the alternative is
reasonable and appropriate.

4. To log on to computers, all our employees use the same password and ID. Is this okay under HIPAA?
a. No. Under the HIPAA Security Rule, covered entities, regardless of their size, are required, under §
164.312(a)(2)(i) to “assign a unique name and/or number for identifying and tracking user identity.” A “user”
is defined in § 164.304 as a “person or entity with authorized access.”
b. Yes. Under the HIPAA Security Rule, small entity exception covered entities with fewer than ten
(10) users under § 164.312(a)(22)(i) to “assign a common name and/or number for identifying and tracking
user identity.” A “user” is defined in § 164.304 as a “person or entity with authorized access.”

5. Was it a violation of the HIPAA for Northeast Women’s Healthcare Clinic to report the patient to law
enforcement?
a. Yes, it was a violation of Northeast Women’s Healthcare Clinic. Healthcare providers may only provide
patient information pursuant a court-ordered warrant, subpoena, or summons.
b. No, when checking-in the patient gave a fake driver license and that is a crime which occurred on
Northeast Women’s Healthcare Clinic premise. Healthcare providers, under HIPAA, may be report crimes that
occur at their premise to law enforcement.

6. Does the HIPAA Privacy Rule require covered entities to keep patients’ medical records for any period
of time?
a. No. But, HIPAA does require that records pertaining to HIPAA privacy rights be retained for 6
years.
b. Yes. HIPAA requires that all medical records be retained for 6 years
c. Yes. HIPAA only requires that genetic testing records be retained for 6 years

7. Where must the Notice of Privacy Practices be posted?
a. On health plan’s and health care provider’s consumer website
b. On the health plan’s and health care FaceBook and other social media pages
c. In a clear and easy to find location at health care provider offices
d. A and C, but not B
e. A and B, but not C

8. Who are your potential HIPAA Business Associates?
Select the best choice!
a. Your landlord
b. Your email provider
c. Your business consultant
d. Your virtual cloud provider
e. Your web-based practice manage provider
f. LogMeIn
g. All but A
h. All but A and F
i. All but F and E

9. Get the answers instantly!
http://gettinslaw.com/hipaa/category/hipaa/pop-quiz/