HIPAA basics and record retention for Oregon therapists

Check what you learned

10 questions from this lesson. Answers are checked as you go; nothing is recorded.

1. 1 / 10

   When does a health care provider become a HIPAA covered entity?

   AWhen it transmits health information electronically for a covered transactionBWhen it stores paper records of client sessionsCWhen it sees any patients in OregonDWhen it offers cash‑only services
   Hint

   Look at the definition of covered entity in the lesson.

2. 2 / 10

   What is the first required component of the Security Rule’s security management process?

   APatient consent formsBPhysical lock on the office doorCEmployee background checksDRisk analysis
   Hint

   The lesson describes the opening standard of the Security Rule.

3. 3 / 10

   Which document must be signed with every vendor that creates, receives, stores, or transmits PHI on your behalf?

   AService level agreementBLetter of intentCNon‑disclosure agreementDBusiness associate agreement (BAA)
   Hint

   See the section on Business associate agreements.

4. 4 / 10

   Under HIPAA, how long must you retain policies, procedures, and documented assessments?

   ASeven years from the date of the last client sessionBIndefinitelyCSix years from creation or last effective date, whichever is laterDTen years from the start of the practice
   Hint

   Refer to the two‑clock retention discussion.

5. 5 / 10

   What triggers the requirement to notify affected individuals of a breach?

   AThe breach involves fewer than 500 peopleBThe breach is reported to the state attorney generalCA documented risk assessment shows a low probability the information was compromisedDThe breach is an impermissible acquisition, access, use, or disclosure of PHI
   Hint

   Look at the definition of a breach in the lesson.

6. 6 / 10

   When must notice be given to each affected person after a breach is discovered?

   ANo later than 60 calendar days after discoveryBWithin 30 days of the breachCImmediately after the breach is reported to HHSDWithin 90 days of the end of the calendar year
   Hint

   Check the breach notification timing requirements.

7. 7 / 10

   How many years must Oregon therapists retain clinical records according to their licensing board?

   ASix years from the date the record was createdBSeven years from the date of last serviceCTen years from the start of practiceDFive years from the date of last service
   Hint

   See the section comparing HIPAA’s six‑year clock to the board’s seven‑year clock.

8. 8 / 10

   What must a private‑practice social worker in Oregon name in case of death or incapacity?

   AAn insurance carrierBThe state licensing boardCA family member of the clientDA qualified person or records management company
   Hint

   Look at the requirements for regulated social workers.

9. 9 / 10

   If a BAA signed in 2020 is replaced in 2024, until what year must the original BAA be retained?

   A2030B2032C2029D2026
   Hint

   Consider the six‑year retention rule for HIPAA paperwork.

10. 10 / 10

    Which of the following is NOT a required safeguard under the Security Rule’s proposed changes?

    AMandatory encryption of all data at restBWritten technology asset inventoryCMultifactor authenticationDA network map
    Hint

    Review the proposed rule’s listed changes.