Medical Billing And Reimbursement Practice Exam

HIPAA's Privacy and Security rules revolve around protecting a patient's health information and ensuring it is handled securely. The Privacy Rule sets who may access or disclose PHI and gives patients rights over their data. The Security Rule requires safeguards for electronic PHI—administrative, physical, and technical controls to prevent unauthorized access, disclosure, alteration, or destruction. In addition, the Breach Notification Rule requires that when unsecured PHI is breached, affected individuals (and sometimes authorities) are notified. The best summary, then, is that HIPAA protects PHI and requires secure data handling with a mechanism for notifying individuals when a breach occurs. The other statements misstate aspects: consent for all disclosures is not required and breach notification does exist; HIPAA applies to more than just electronic records (PHI in any form is covered by privacy protections, with electronic safeguards specifically for ePHI); and HIPAA covers more than just hospitals, extending to covered entities like providers, health plans, and their business associates.