Which of the following is considered PHI under HIPAA?

Prepare for the Board Certified-TeleMental Health Provider Test. Enhance your skills with multiple choice questions and flashcards. Each question includes explanations and hints. Master your exam!

Multiple Choice

Which of the following is considered PHI under HIPAA?

PHI is health information that can identify a patient and relates to the patient’s health care or payment for care, and it can exist in any medium. The items listed—referrals, scheduling, consent forms, document sharing, billing, clinical notes, and communications—clearly contain health information tied to a specific person, so they are PHI. The note that PHI includes “devices used to obtain or transmit information” reinforces that PHI is about the information itself, not the device used to store or send it; PHI can be stored on or transmitted via electronic devices. Public health statistics derived from aggregated data are not PHI because they are de-identified or grouped so individuals can’t be identified. The statement that PHI does not include electronic devices is misleading because PHI can exist electronically; the devices are simply the medium, not the PHI itself. Staff training materials about privacy aren’t PHI unless they contain actual patient information; otherwise they’re general privacy content.

PHI is health information that can identify a patient and relates to the patient’s health care or payment for care, and it can exist in any medium. The items listed—referrals, scheduling, consent forms, document sharing, billing, clinical notes, and communications—clearly contain health information tied to a specific person, so they are PHI. The note that PHI includes “devices used to obtain or transmit information” reinforces that PHI is about the information itself, not the device used to store or send it; PHI can be stored on or transmitted via electronic devices.

Public health statistics derived from aggregated data are not PHI because they are de-identified or grouped so individuals can’t be identified. The statement that PHI does not include electronic devices is misleading because PHI can exist electronically; the devices are simply the medium, not the PHI itself. Staff training materials about privacy aren’t PHI unless they contain actual patient information; otherwise they’re general privacy content.

More practice questions