Content Area IX, RHIT Exam: Health Information Privacy and Security

The administrator states that he should not have to participate in privacy and security training as he does not use PHI. How should you respond?

"All employees are required to participate in training, including top administration"

Which of the following statements demonstrates a violation of protected health information?

"Mary, at work yesterday I saw that Susan had a hysterectomy"

The hospital has received a request for an amendment. How long does the facility have in order to accept or deny the request?

30 days

Which of the following statements is true about a requested restriction?

ARRA mandates that a CE must comply with a requested restriction unless it meets one of the exceptions

Mountain Hospital has discovered a security breach. Someone hacked into the system and viewed 50 medical records. According to ARRA, what is the responsibility of the covered entity?

All individuals must be notified within 60 days

Which of the following techniques would a facility employ for access control?

Automatic log-off Unique user identification

Which security measure utilizes fingerprints or retina scans?

Biometrics

A patient's medical record was breached. The written notification that goes out to the patient should contain only a message to call the hospital

False statement - the patient should receive a brief description of the breach, what the covered entity is doing about the breach, what the patient should do, and whom to contact

Dr. Brown has just approved the patient's request to amend the medical record. Dr. Brown has routed the request with his approval to the HIM Department. What should the HIM Department do?

File the request where the erroneous information is located and send a copy of the amendment to anyone who has a copy of the erroneous information plus anyone the patient requests

Which of the following statements is true about the Privacy Act of 1974?

It applies to the federal government

Margaret looked up PHI on her ex-sister-in-law. A routine audit discovered the violation. Which statement is true under ARRA?

Margaret cannot be prosecuted since she is not a covered entity

Mark, a patient of Schnering Hospital, has asked for an electronic copy of his medical record to go to his physician. According to ARRA, what is the CE's obligation to Mark?

Mark has a right to an electronic copy or to have it sent to someone else

Mary processed a request for information and mailed it out last week. Today, the requestor, an attorney, called and said that all of the requested information was not provided. Mary pulls the documentation, including the authorization and what was sent. She believes that she sent everything that was required. She confirms this with her supervisor. The requestor still believes that some extra documentation is required. Given the above information, which of the following statements is true?

Mary is not required to release the extra documentation because the facility has the right to interpret a request and apply the minimum standard rule

Which of the following disclosures would require patient authorization?

Release to patient's attorney

You are looking for potential problems and violations of the privacy rule. What is this security management process called?

Risk assessment

Which of the following should the record destruction program include?

The method of destruction

A patient has submitted an authorization to release information to a physician office for continued care. The release of information clerk wants to limit the information provided because of the minimum necessary rule. What should the supervisor tell the clerk?

The patient is an exception to the minimum necessary rule, so process the request as written

Barbara, a nurse, has been flagged for review because she logged in to the EHR in the evening when she usually works the day shift. Why should this conduct be reviewed?

This needs to be investigated before a decision is made because there may be a legitimate reason why she logged in at this time

Physical safeguards include:

Tools to control access to computer systems Fire protection

Nicole is developing an agreement that will be used between the hospital and the health care clearing house. This agreement will require the two parties to protect the privacy of data exchanged. This is called

a business associate agreement

You have been asked to provide examples of technical security measures. Which of the following would you include in your list of examples?

automatic logout

The computer system containing the electronic health record was located in a room that was flooded. As a result, the system is inoperable. Which of the following would be implemented?

business continuity processes

Alisa has trouble remembering her password. She is trying to come up with a solution that will help her remember. Which one of the following would be the BEST practice?

creating a password that utilizes a combination of letters and numbers

Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be re-created by authorized users. This technique is called

data encryption

Intentional threats to security could include

data theft

As Chief Privacy Officer for Premier Medical Center, you are responsible for which of the following?

developing a plan for reporting privacy complaints

Contingency planning includes which of the following processes?

disaster planning

You are defining the designated record set for South Beach Healthcare Center. Which of the following would be included?

discharge summary

You are writing a policy on how to document the amendment process. What information should be required by the policy?

documentation of a request, a refusal, and a patient's right to write a statement of disagreement

The surgeon comes out to speak to a patient's family. He tells them that the patient came through the surgery fine. The mass was benign and they could see the patient in an hour. He talks low so that the other people in the waiting room will not hear but someone walked by and heard. This is called a (n)

incidental disclosure

Patricia is processing a request for medical records. The record contains an operative note and a discharge summary from another hospital. The records are going to another physician for patient care. What should Patricia do?

include the documents from the other hospital

A mechanism to ensure that PHI has not been altered or destroyed inappropriately has been established. This process is called

integrity

I have been asked if I want to be in the directory. The admission clerk explains that if I am in the directory

my friends and family can find out my room number

Facility access controls, workstation use, workstation security, and device/media controls are all part of

physical safeguards

America LTD has developed a PHR. According to ARRA, the health information that they store is

protected

Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely Selected Answer: Incorrect

psychotherapy notes

Which of the following would be a business associate?

release of information company

You are writing a policy for the release of information area. This policy will include the requirements for a valid authorization. Which of the following would not be included?

request for an accounting of disclosure

You are reviewing your privacy and security policies, procedures, training programs, and so on, and comparing them to the HIPAA and ARRA regulations. You are conducting a

risk assessment

Kyle, the HIM Director, has received a request to amend a patient's medical record. The appropriate action for him to take is

route the request to the physician who wrote the note in question to determine the appropriateness of the amendment

You work for a 60-bed hospital in a rural community. You are conducting research on what you need to do to comply with HIPAA. You are afraid that you will have to implement all of the steps that your friend at a 900-bed teaching hospital is implementing at his facility. You continue reading and learn that you only have to implement what is prudent and reasonable for your facility. This is called

scalable

Encryption, access control, emergency access to records, and biometrics are examples of

technical security

The HIPAA security rule does not require specific technologies to be used but rather provides direction on the outcome. The term used to describe this philosophy is

technology neutral

Which of the following situations violate a patient's privacy?

the hospital provides patient names and addresses to a pharmaceutical company to be used in a mass mailing of free drug samples

Which statement is true about when a family member can be provided with PHI?

the patient's mother can always receive PHI on her child

Your department was unable to provide a patient with a copy of his record within the 30-day limitation. What should you do?

write the patient and tell him that you will need a 30-day extension

Margaret has signed an authorization to release information regarding her ER visit for a fractured finger to her attorney. Specifically, she says to release the ER history and physical, x-rays, and any procedure notes related to a finger fracture with laceration. Which of the following violates her privacy if released based on this authorization?

x-ray of chest