Privacy and Security Standards Flashcards
7 cards from real CEC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy and Security Standards flashcards as text
Under HIPAA, which of the following is considered Protected Health Information (PHI)?
Answer: A patient's diagnosis combined with their name
PHI is individually identifiable health information that includes identifiers such as name combined with health data like a diagnosis.
A Marketplace Navigator receives a paper application containing an applicant's SSN. What is the most appropriate way to store this document?
Answer: Store it in a locked cabinet with restricted access
Sensitive documents containing SSNs must be secured in locked storage with access limited to authorized personnel.
Which federal law primarily governs the privacy of student education records and is relevant when assisting student-aged applicants?
Answer: FERPA
FERPA (Family Educational Rights and Privacy Act) protects the privacy of student education records.
An enrollment counselor accidentally sends an applicant's eligibility information to the wrong email address. This is an example of a:
Answer: Unauthorized disclosure requiring notification
Sending PII or PHI to an unintended recipient constitutes an unauthorized disclosure that may trigger breach notification requirements.
What does 'minimum necessary' mean in the context of HIPAA privacy rules for enrollment counselors?
Answer: Access or share only the amount of PHI needed to complete the task
The minimum necessary standard requires that access to PHI be limited to only what is needed to accomplish the intended purpose.
Which of the following is a 'safe harbor' de-identification method under HIPAA?
Answer: Removing all 18 specific identifiers defined by HIPAA
HIPAA's Safe Harbor method requires removing all 18 specified identifiers to ensure data cannot identify an individual.
When an applicant asks who has access to their enrollment application data, the enrollment counselor should:
Answer: Explain the privacy notice and describe authorized data access
Counselors are required to provide applicants with a privacy notice that explains who may access their information and for what purposes.