citi exam 4
| 1. | A covered entity may use or disclose PHI without an authorization, or documentation of a waiver or an alteration of authorization, for all of the following EXCEPT: | Data that does not cross state lines when disclosed by the covered entity. | |
| 2. | HIPAA includes in its definition of “research,” activities related to … | Development of generalizable knowledge. | |
| 3. | The HIPAA “minimum necessary” standard applies… | To all human subjects research that uses PHI without an authorization from the data subject. | |
| 4. | HIPAA protects a category of information known as protected health information (PHI). PHI includes: | Identifiable health information that is created or held by covered entities and their business associates. | |
| 5. | HIPAA’s protections for health information used for research purposes… | Supplement those of the Common Rule and FDA. | |
| 6. | If you’re unsure about the particulars of HIPAA research requirements at your organization or have questions, you can usually consult with: | An organizational IRB or Privacy Board, privacy officer (“Privacy Officer”), or privacy official (“Privacy Official”), depending on the issue. | |
| 7. | Recruiting into research … | Can qualify as an activity “preparatory to research,” at least for the initial contact, but data should not leave the covered entity. | |
| 8. | Under HIPAA, a “disclosure accounting” is required: | For all human subjects research that uses PHI without an authorization from the data subject, except for limited data sets. | |
| 9. | Under HIPAA, “retrospective research” (a.k.a., data mining) on collections of PHI generally … | Is research, and so requires either an authorization or meeting one of the criteria for a waiver of authorization. |