HIPAA/Phi Banditz Compliance Quiz
Annual HIPAA compliance validation
- 1.
HIPAA security and privacy regulations apply to:
- A.
Attending physicians, nurses, and other healthcare professionals.
- B.
Health information managers, information systems staff, and other ancillary personnel only.
- C.
Anyone working in the facility.
- D.
Only staff that have direct patient contact.
Correct Answer
C. Anyone working in the facility.Explanation
HIPAA security and privacy regulations apply to anyone working in the facility, not just specific groups of individuals. This means that all employees, regardless of their role or level of patient contact, must comply with these regulations. This ensures that the privacy and security of patient health information is protected throughout the entire organization, reducing the risk of unauthorized access or disclosure.Rate this question:
-
- 2.
Copies of patient information may be disposed of in any garbage can in the facility.
- A.
True
- B.
False
Correct Answer
B. FalseExplanation
Patient information should never be disposed of in regular garbage cans as it contains sensitive and confidential information. Proper disposal methods, such as shredding or incineration, should be followed to ensure the privacy and security of patient data.Rate this question:
-
- 3.
Your co-worker ran to get lunch and forgot to lock his computer. The compliance friendly response is to:
- A.
Email Ken Jones and Joe Sneddon to let them know there was a violation
- B.
Email your co-worker's supervisor notifying of the mistake, but then lock his computer for him
- C.
Lock his computer for him
- D.
BOF him with a ridiculous email
Correct Answer
C. Lock his computer for himExplanation
Locking your co-worker's computer for him is the compliance friendly response because it ensures that his computer is secure and protected from unauthorized access while he is away. Notifying Ken Jones and Joe Sneddon or his supervisor about the violation may be necessary, but the immediate action should be to lock the computer to prevent any potential breaches or misuse of sensitive information. BOFing him with a ridiculous email is unprofessional and does not address the security concern.Rate this question:
-
- 4.
You lose your work phone at the airport. Your next steps would normally include all of the following except:
- A.
Call the police
- B.
Fill out the lost item form
- C.
Contact IT Support
- D.
Call your supervisor or manager
Correct Answer
A. Call the policeExplanation
When you lose your work phone at the airport, your next steps would normally include filling out the lost item form, contacting IT support, and calling your supervisor or manager. However, calling the police is not typically necessary in this situation as it is not a criminal matter. The police may not be able to assist in finding a lost item and their involvement would be more appropriate for cases involving theft or other criminal activities.Rate this question:
-
- 5.
After working in the car on the ride home, you stop at Trader Joes for groceries. The compliance related consequence of these two actions is:
- A.
You must remember to lock your computer in the trunk before you go into Trader Joes
- B.
It's ok to leave your computer in the car as long as no one is watching
- C.
You should bring your computer into Trader Joes with you
- D.
You got all your work done and have groceries … Dinner time!
Correct Answer
C. You should bring your computer into Trader Joes with youExplanation
Bringing your computer into Trader Joes with you is the compliance related consequence of working in the car on the ride home and stopping at Trader Joes for groceries. This is because leaving your computer unattended in the car can pose a security risk, as someone could potentially break into the car and steal it. Therefore, it is recommended to bring the computer with you to ensure its safety.Rate this question:
-
- 6.
Your friend from undergrad just got an offer from Huron and is asking for some details about the job on Facebook. What should you do?
- A.
Comment back. Facebook is your personal life.
- B.
Any communication on social media needs to be prefaced with a disclaimer that this is your opinion only
- C.
If this is a private Facebook message you can respond back since no one will else see it
- D.
Tell your friend to ask you on Twitter instead
Correct Answer
B. Any communication on social media needs to be prefaced with a disclaimer that this is your opinion onlyExplanation
When discussing job details on social media, it is important to preface any communication with a disclaimer stating that the information provided is solely your opinion. This helps to avoid any potential misunderstandings or misinterpretations, as social media platforms are often seen as personal spaces where opinions are freely expressed. It is not necessary to suggest using a different social media platform like Twitter, as the main concern is about providing a disclaimer rather than the specific platform being used.Rate this question:
-
- 7.
When filling out the client documentation sign-off form, which of the dates listed is not required:
- A.
The date you rolled out a new process
- B.
The date you create draft process documentation
- C.
The date you evaluated the client's current process
- D.
The date you presented the final process documentation to your client
Correct Answer
A. The date you rolled out a new processExplanation
The date you rolled out a new process is not required because the client documentation sign-off form is specifically for documenting the process and its evaluation, not the implementation or rollout of the process. The form focuses on the creation, evaluation, and presentation of the process documentation to the client, not the actual implementation date.Rate this question:
-
- 8.
Huron Healthcare's compliance policy requires that project teams retain a number of project related documents to mitigate potential legal risk. Which document is not required for retention?
- A.
Project Quality Audit (QA) reports
- B.
Updates provided to internal Huron Healthcare executive management
- C.
Copy of Engagement MD Certification form signed by MD
- D.
Internal team meeting agendas
Correct Answer
D. Internal team meeting agendasExplanation
The correct answer is "Internal team meeting agendas". While all the other documents mentioned in the options are required for retention according to Huron Healthcare's compliance policy, internal team meeting agendas are not specifically mentioned. The policy may require the retention of important project-related documents such as the Project Quality Audit (QA) reports, updates provided to internal Huron Healthcare executive management, and a copy of the Engagement MD Certification form signed by MD. However, meeting agendas may not be considered as crucial for legal risk mitigation and may not be required to be retained.Rate this question:
-
- 9.
Your coworker rented a sweet Jeep from National this week. Good news is you are riding in style! Bad news is:
- A.
You must lock your computer in the car
- B.
You cannot lock your computer in the car because it does not have a fully enclosed trunk
- C.
You must hide your laptop out of sight, like under the seat
- D.
You can still lock your computer in the trunk
- E.
None of the above
Correct Answer
B. You cannot lock your computer in the car because it does not have a fully enclosed trunkExplanation
The correct answer is that you cannot lock your computer in the car because it does not have a fully enclosed trunk. This means that leaving your computer in plain sight would make it vulnerable to theft.Rate this question:
-
- 10.
Your client counterpart sends you, several other Huron employees, and an outside vendor an entire ATB listing of EVERY patient currently in Accounts Receivable which contains: account numbers, addresses, Medical Record Numbers, first and last names, phone numbers, and admit and discharge dates as an upload on SecureFile. What is the absolute FIRST thing that you should do?
- A.
Panic, but then remove all PHI from the email and reply back to the client notifying them of the PHI violation and how to properly transmit PHI in the future
- B.
Notify your supervisor
- C.
Nothing, use the PHI if needed and then delete it
- D.
Notify your director
Correct Answer
C. Nothing, use the PHI if needed and then delete it -
- 11.
When sending PHI in Outlook to your client, which answer is true?
- A.
Disable the auto-fill feature in Outlook so emails are not sent to the wrong person
- B.
"PHI" must be included in the subject line of the email
- C.
"[encrypt]" must be included in the subject line of the email
- D.
I'm not allowed to send PHI via Huron Outlook on my current project
Correct Answer
D. I'm not allowed to send PHI via Huron Outlook on my current project -
- 12.
You received PHI via email from your client. Your immediate next steps are to:
- A.
Make the client upload the file to secure file
- B.
Notify the client that this is not an appropriate way to send PHI
- C.
Delete the PHI completely from your computer
- D.
B and C
- E.
All of the Above
Correct Answer
B. Notify the client that this is not an appropriate way to send PHIExplanation
The correct answer is to notify the client that this is not an appropriate way to send PHI. This is the immediate next step to take when receiving PHI via email from a client. It is important to educate the client about the proper methods of transmitting sensitive information and to discourage the use of insecure channels such as email. Deleting the PHI from the computer is also necessary to ensure that the information is not compromised. Therefore, options B and C are both correct, making "All of the Above" the correct answer.Rate this question:
-
- 13.
After receiving unencrypted PHI from the client, you are ready to fill out the PHI Violation Disclosure Form. You must include detailed information on all of the following except:
- A.
When the violation occurred
- B.
Who conducted the violation
- C.
That you informed the violator that it was not allowed
- D.
The appropriate way to send PHI from client to Huron
Correct Answer
D. The appropriate way to send PHI from client to HuronExplanation
The question asks for information that should not be included in the PHI Violation Disclosure Form. The correct answer states that the appropriate way to send PHI from the client to Huron should not be included in the form. This suggests that the form is specifically focused on documenting violations and their details, rather than providing instructions or guidelines on how to handle PHI transmission.Rate this question:
-
- 14.
The client has requested that you create an instruction guide/cheat sheet on a process within Epic, what cannot be included in the guide?
- A.
Epic terminology
- B.
Epic field references
- C.
Epic screenshots
- D.
We're the best at making instructions guides for the client!
Correct Answer
C. Epic screenshotsExplanation
Epic screenshots cannot be included in the guide because the client has specifically requested for an instruction guide/cheat sheet, which implies that they want a written document with step-by-step instructions. Screenshots may not be necessary or practical for this type of guide and can make the document unnecessarily long and cluttered.Rate this question:
-
- 15.
When should we remove the PHI data from our computers and sharepoint sites?
- A.
PHI data should not be stored unless we need it to complete an active project.
- B.
PHI should always be destroyed once the project is completed or the data is no longer required to support the project objectives.
- C.
PHI data can be stored as long as I need it
- D.
A & B
- E.
A , B, & C
Correct Answer
D. A & BExplanation
The correct answer is A & B. The explanation for this is that PHI data should not be stored unless it is needed to complete an active project. Additionally, PHI should always be destroyed once the project is completed or the data is no longer required to support the project objectives. This ensures that the sensitive PHI data is not unnecessarily stored or retained, reducing the risk of unauthorized access or breaches.Rate this question:
-
- 16.
Which of the following steps should you take to mitigate risk of laptop theft or loss of Huron data?
- A.
Use physical cable locks to lock down laptops at Huron offices and client sites
- B.
Obtain privacy screens that limit viewing when traveling or working in open work areas
- C.
Do not use another person’s logon name or credentials to access client or Huron systems at any time
- D.
Lock your laptop with username/password when leaving it unattended
- E.
All the above
Correct Answer
E. All the aboveExplanation
Using physical cable locks to lock down laptops at Huron offices and client sites can deter theft and prevent unauthorized access. Obtaining privacy screens can limit viewing and protect sensitive data when working in open areas. Not using another person's logon name or credentials ensures accountability and prevents unauthorized access. Locking the laptop with a username/password when leaving it unattended adds an extra layer of security. Therefore, taking all these steps can effectively mitigate the risk of laptop theft or loss of Huron data.Rate this question:
-
- 17.
It is only necessary for Huron to complete the “Report to Huron of Possible HIPAA Compliance Issue” form if we are responsible for the security breach. If the client is responsible, e.g., sends an email that contains PHI, it is the client’s responsibility to report the issue.
- A.
True
- B.
False
Correct Answer
B. FalseExplanation
Huron is not responsible for completing the "Report to Huron of Possible HIPAA Compliance Issue" form only if they are responsible for the security breach. If the client is responsible for the breach, such as by sending an email that contains PHI, it is still Huron's responsibility to report the issue. Therefore, the statement is false.Rate this question:
-
- 18.
Due to the “auto-fill” feature in Outlook, you mistakenly email a confidential client document to a friend, rather than to the client whose name is (unfortunately) very similar. What should you do?
- A.
Contact the friend and ask that he delete the email without reading it.
- B.
Try to “recall” the message and determine whether the recall was successful.
- C.
Report the disclosure immediately to Huron’s Chief Compliance Officer so that additional, required actions can be determined.
- D.
Contact Huron IT.
- E.
A and B
- F.
All of the above
Correct Answer
F. All of the aboveExplanation
In this situation, all of the options mentioned are appropriate actions to take. Contacting the friend and asking them to delete the email without reading it is important to minimize the risk of the confidential information being accessed by unauthorized individuals. Trying to "recall" the message is also a good step to take, although its success cannot be guaranteed. Reporting the disclosure immediately to Huron's Chief Compliance Officer is crucial as they can assess the situation and determine any additional actions that need to be taken. Contacting Huron IT is also necessary to inform them of the mistake and seek their guidance. Therefore, all of the above options should be followed.Rate this question:
-
- 19.
The client sent you an Epic report from Reporting Workbench, where can you save this file?
- A.
Anywhere – Epic reports can be saved
- B.
I can only save it on the client owned server
- C.
I cannot save this file as it has Epic screenshots
- D.
I can temporarily save it to complete my job and then delete it immediately
Correct Answer
A. Anywhere – Epic reports can be savedExplanation
Epic reports can be saved anywhere because they are not restricted to a specific location or server. This flexibility allows the client to choose where they want to save the file based on their own preferences or requirements.Rate this question:
-
- 20.
The client sent you a document containing a workflow outlining the new procedures within Epic with screenshots that the Epic IT contact sent along. Where can you save this file?
- A.
Anywhere - I did not create this document
- B.
I can save it on the client owned server
- C.
I cannot save this file as it has Epic screenshots
- D.
I need to save it to complete my job
Correct Answer
B. I can save it on the client owned serverExplanation
The correct answer is "I can save it on the client owned server". The reason for this is that the client owns the document and it is their responsibility to decide where it should be saved. Saving it on the client owned server ensures that the document is stored securely and can be accessed by the client and other authorized individuals as needed.Rate this question:
-
Quiz Review Timeline +
Our quizzes are rigorously reviewed, monitored and continuously updated by our expert board to maintain accuracy, relevance, and timeliness.
-
Current Version
-
Mar 21, 2023Quiz Edited by
ProProfs Editorial Team -
Jul 14, 2015Quiz Created by
Lazylilpanda
Back to top