Start practicing

Ethics & Law · single question

Under HIPAA, which of the following is an EXCEPTION to what a covered entity must do to maintain compliance?

  1. Provide patients access to their own health information within 30 days
  2. Train all workforce members on HIPAA policies
  3. Accommodate appointments for a privacy official and a security official
  4. Notify affected patients if unsecured PHI was shared on social media
Show answer and explanation

Correct answer: C. Accommodate appointments for a privacy official and a security official

  • A. The HIPAA Privacy Rule requires covered entities to provide individuals access to their PHI, generally within 30 days.
  • B. Workforce training on HIPAA policies and procedures is explicitly required under the Privacy and Security Rules.
  • C. Correct (this was the 'except' answer in the source). Appointing a privacy and security official is required, but formally 'accommodating appointments' for them as a patient-facing requirement is not an explicit HIPAA mandate — the question is testing recognition of what is NOT required of covered entities.
  • D. Notifying affected individuals of a breach of unsecured PHI is a mandatory HIPAA Breach Notification Rule requirement.

Practice Ethics & Law questions Ethics & Law study notes

More Ethics & Law practice questions