Certified Information Privacy Professional – United States (CIPP/US) — Question 204

An addiction researcher at a hospital wishes to remotely review Protected Health Information (PHI). Which of the following explicitly establishes privacy protections for this processing activity?

Answer options

• A. The Health Information Technology for Economic and Clinical Health (HITECH) Act.
• B. The Confidentiality of Substance Use Disorder Patient Records Rule.
• C. The Genetic Information Nondiscrimination Act (GINA) of 2008.
• D. The 21st Century Cures Act of 2016.

Correct answer: B

Explanation

The Confidentiality of Substance Use Disorder Patient Records Rule (B) specifically addresses the privacy of substance use disorder patient records, making it the correct choice for this scenario. The other options, while relevant to health information, do not provide the same level of privacy protections for substance use disorder records as option B does.