Write "T" or "F" in the blank to indicate whether you think the statement is true or false. 31. Individually identifiable health information (IIHI) is any part of a person's health data (e.g., demographic information, address, date of birth) obtained from the patient that is created or received by a covered entity. 32. HIPAA requirements protect disclosure of PHI outside of the organization but do not protect against inter- nal use of health information. 33. Under HIPAA, patients may request confidential communications and may restrict certain disclosures of PHI. 34. It is not necessary to turn documents over or lock them in a secure drawer if you are only leaving your desk for a few moments. 35. Texting on cellphones is a secure method for discussing patient care. 36. Under HIPAA privacy regulations, patients do not have the right to access psychotherapy notes. 37. The HITECH Act requires that business associates comply with the HIPAA Security Rule in the same man- ner that a covered entity would. 38. A billing specialist does not need to be concerned about HIPAA violations because only providers may face penalties and imprisonment. 39. An allowable incidental disclosure occurs when someone hears you discussing a patient over dinner. 40. The penalty for violating HIPAA and HITECH can be $100 to $50,000 or more per violation