D. Congress passed the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) to give the Department of Health and Human Services (“DHHS”) the authority to regulate the security and privacy of patient information.

Although PHI is three letters of the alphabet, the best answer is Protected Health Information. D is almost correct, but covered entities do not have to protect all confidential consumer information under HIPAA, only that portion of such information that is PHI.

A is correct as being the maximum penalty for improperly using or disclosing individually identifiable health information for commercial advantage, personal gain, or malicious harm. D is the penalty for such use or disclosure that is not for the improper reasons specified in A.

D is correct because HIPAA requires immediate action to report or correct not only an actual breach of confidentiality, but also a violation of HIPAA or your employer’s policies protecting PHI even if they do not result in an actual breach.

D is correct. All of the obligations are required.

B. False. HIPAA preempts (does away with) federal and state law that is inconsistent with HIPAA except, among others, laws that give more privacy protection than HIPAA, such as AIDS, mental health, and substance abuse confidentiality laws. Thus, you must continue to comply with those laws, as well as with HIPAA.

B. False. In virtually every state and the federal system, an employee does not have an expectation of privacy in his or her employer’s computer equipment that the employee uses at work. Thus, the employer can (and must) audit for HIPAA compliance.

B. False. You may be subject to employee discipline for failure to take corrective action when a coworker breaches HIPAA or for failure to report the breach.

A. True. Unless your employer prohibits such use, HIPAA does not prohibit using personal devices so long as the use is HIPAA compliant.

D. All of the above. You must be familiar with all of your employer’s policies and procedures for protecting PHI.

B. False. The duty to maintain confidentiality of PHI under HIPAA and many other federal and state laws extends past the termination of employment.

B. False. Not only are technical security measures not the only measures, but also they may actually be the least effective. Physical security is very important. If a person cannot access a terminal, he or she cannot attempt to defeat a log-on procedure. Similarly, administrative security measures, such as a sanction policy to control behavior—to force workers to follow policies and procedures—may be more effective than technical security measures.

A. True. Failure to report, however, could result in employee discipline.

C. Is the correct answer

B. The proper procedure when you don’t understand a policy or procedure is to seek clarification from a supervisor, the privacy or security officer, or other competent person.

E. Is the correct answer

A is the correct answer. HIPAA restricts access to individuals who have a bona fide need to know.

B. False. The minimum necessary rule does not apply to PHI obtained, used, or disclosed for treatment (clinical) purposes.

B. False. Forwarding an email containing a dirty joke at work is improper for several reasons, including creating a hostile work environment and violation of an employer’s email policy.

A. True. You have been trained. It’s now up to you!