HIM: Ch 11 Slides

A valid authorization for disclosure of information is required for the following:

-Disclosure of PHI not permitted to be released without an authorization -Psychotherapy notes -Marketing -Sale of PHI

Use and Disclosure without Authorization

-For the purpose of treatment, payments, or healthcare operations (TPO) -Accounting of disclosures -De- identification -Expert determination method -Safe harbor method Re- identification

Biometric Authentication

Allows a user to be uniquely identified and access the system based on one or more biometric traits such as fingerprints, hand geometry, retinal pattern, or voice waves

Software criticality analysis

Assessing systems to determine how crucial the information in the system is to day-to-day healthcare operations and patient care

HIPAA Enforcement

Compliance *internal* Investigations *internal or external* Penalties for violations *internal or external* Procedures for hearings Corrective action plan (CAP) Civil monetary penalty (CMP) Reasonable cause Willful neglect

Emergency mode operation plan

Creates processes and procedures to support the continuation of critical business and patient care operations while protecting the security of ePHI in the event of a disaster

Expert determination method

Data elements that could identify an individual are removed from the data and then an expert, statistician, applies scientific methodology to determine the likelihood of identification of the individual

Data at rest

Data is in storage within a database or on a server where it is no longer being used or accessed

Confidentiality

Data or information is not made available or disclosed to unauthorized people

Disaster recovery plan

Defines the processes for recovery of data in the event of a disaster

Is authorization needed for patient requests record be released to her daughter to support patient care

Depends on age of patient (13 years)

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

Ensures health insurance portability Establishes standards for electronic claims and national identifiers Protects against fraud and abuse Assures the privacy and security of protected health information (PHI)

Logic bombs

Malware that will execute a program or a string of code, when a certain event happens.

A healthcare organization send medical records to the insurance company for payment of services

No authorization

Is authorization needed for patient does not want his/her name in the patient directory

Oral Authorization Needed

Data backup plan

Organizations must create and store exact copies of electronic protected health information Defines how the system is being backed up, the method of backing up the data, location of the backup, frequency of the backup, and testing of the backup

Privacy Rule

Organizations must implement policies and procedures to address each standard and a process to ensure that they are being followed

Challenges of Privacy and Security in HIE

Patient identity/patient matching Consumer privacy/patient rights

Security

Physical and electronic protection of information

Contingency plan (disaster plan)

Prepares organizations for an event that may happen which could impact the ability to access patient information, the integrity of the information, or the confidentiality of information

Elements of Protecting Patient Information

Privacy Confidentiality Security

Minimum neccessary

Privacy Rule standard that requires that a covered entity or business associate make reasonable efforts to limit PHI

Emergency access

Procedures for getting access to the necessary ePHI in the event of an emergency situation

Security Rule

Required vs. addressable standards Administrative safeguards Physical safeguards Technical safeguards Organizational safeguards

Best practices of Privacy and Security in HIE

Risk analysis Policies and procedures Dedicated individual or team Education of the workforce

Contrary

State law cannot be complied with when 1) covered entity determines that it is impossible to comply with federal and state privacy regs, 2) complance with the state law would create a barrier to compliance with the fed. regs.

d. all of the above, p 308

The Privacy Rule was established to a. protect the rights of healthcare consumers b. improve the efficiency and effectiveness of healthcare delivery c. improve the quality of healthcare d. all of the above

Privacy

The right of an individual to be let alone

Breach Notification Rule

Unauthorized uses and disclosures of PHI (private health information) at any time may be considered a breach; Requires covered entities and business associates to investigate/evaluate if a breach occurred using specific guidelines/protocols *Risk assessment

Examples of Data Security Methods

User authentication, Encryption, Decryption, Malicious software (malware) management

A lawyer requests a copy of a patient's medical records for a litigation

Written authorization

Providers office calls to retrieve emergency room records for a patient's follow up appointment

Written authorization

Trojan horse

a destructive piece of programming code hidden in another piece of programming code (a macro or email message) that looks harmless

The process of making sure the correct patient information is being used or disclosed is called a. Verification b. Confirmation c. Authentication d. Certification

a. Confirmation

A covered entity may use protected health information for whatever means deemed appropriate as long as they are the organization that created the protected health information. a. True b. False

a. False (????)p308

Protected health information can be information about a patient that refers to their past, present or future health and conditions. a. True b. False

a. False, Individually identifiable health information p307

A disclosure is the release, transfer, provision of access to, or divulging in any manner of information inside the organization. a. True b. False

a. True

Security is the means by which the privacy and confidentiality of information is maintained. a. True b. False

a. True, 306

If a state's privacy laws are more strict than HIPAA, the covered entity must follow the state law versus HIPAA. a. True b. False

a. True, 308

______ is an example of a biometric identification used for authentication. a. Voice recognition b. Plastic identification cards c. Advanced algorithm methods d. Personalized numeric pin

a. Voice recognition

The purpose of a notice of privacy practices is to inform patients of a. how a healthcare provider may use and share the patient's health information b. the cost of care c. the organization's mission and vision d. the facility's healthcare statistics

a. how a healthcare provider may use and share the patient's health information, p308

The Privacy Rule

allows the patient to agree or object to disclosure of PHI within the facility directory

Reidentification

an org. can apply a specific code, or other means, to the data for future identification purposes; however the specific code cannot be derived from any type of data elements that come from the patient's health info

Malware

any program that causes harm to systems by unauthorized access, unauthorized disclosure, destruction, or loss of integrity of any info

Addressable Standards

as amended by HITECH, the implementation specifications of the HIPPA Security Rule that are designated to "addressable" rather than "required"; covered entity must implement the specification as written, an alternative or document that the res does not apply to the organization or with negligiable probablility

For protected health information to be deidentified per the Safe Harbor Deidentification method, 16 data elements must be removed. a. True b. False

b. False, 18 data elements p316

______ is individually identifiable health information held or transmitted by a covered entity or business associate. a. Designated Record Set b. Protected Health Information (PHI) c. Disclosure List d. Directory Information

b. Protected Health Information (PHI), 307

The ______ requires organizations to implement policies and procedures to safeguard the facility and equipment from unauthorized access, tampering, and theft. a. Contingency Plan b. Security Plan c. Media and Device Controls d. Emergency Mode Operations Plan

b. Security Plan (?)

The HITECH-HIPAA Omnibus Privacy Act a. established the Privacy Rule b. was enacted in response to strengthen HITECH Act privacy and security requirements c. distinguished the difference between privacy, confidentiality, and security d. identified addressable standards for the Security Rule

b. was enacted in response to strengthen HITECH Act privacy and security requirements, 310

______ is text that is considered unreadable or unusable. a. Plaintext b. Cryptographic key c. Ciphertext d. Decryption

c. Ciphertext p327

When implementing a health information exchange, the following two areas were common gaps relating to privacy and security identified by HIMSS and AHIMA: a. Patient consent/authorization and PHI access audit trails b. PHI access audit trails and user authentication c. Patient consent/authorization and restriction of sensitive information d. Restriction of sensitive information and user authentication

c. Patient consent/authorization and restriction of sensitive information, p331

Standards that are mandated and must be implemented as written by the HIPAA Security Rule are called a. Addressable standards b. Terminology standards c. Required standards d. Privacy standards

c. Required standards p309

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 was originally established to achieve all of the following except a. protect against fraud and abuse b. ensure health insurance continuity c. establish standard terminology for EHRs d. set standards for electronic claims

c. establish standard terminology for EHRs, p307

The Privacy and Security Rules require workforce training that a. is conducted face-to-face b. occurs only when an employee is hired c. includes general training, job specific training, and ongoing training d. covers the patient's responsibility in the security of their PHI

c. includes general training, job specific training, and ongoing training, p335

Virus

computer program, typically hidden, that attaches itself to other program (host) and has the ability to replicate and cause various forms of harm to the data

Criticality Analysis

consist of evaluating each of the different systems in the or. to determine how crucial the information in the system is to day-to-day healthcare operations and patient care

A patient has the right to request a(n) ______, which describes where the covered entity has disclosed patient information for the past 6 years outside of treatment, payment, and healthcare operations. a. Disclosure List b. Designated Record Set c. Amendment of Medical Record d. Accounting of Disclosures

d. Accounting of Disclosures, p316

A part of the policy and procedure that should be created to manage access to a health information exchange should address which of the following? a. Termination of user access b. User access establishment c. Patient consent process d. All of the above

d. All of the above p330-331

The following should be established when allowing workforce members to use mobile devices to get access to PHI a. Mobile device policies and procedures b. Procedures for reporting lost or stolen devices c. Acceptable behaviors and use of ePHI on mobile technology d. All of the above

d. All of the above, 332-333

The Security Rule specifies ______ that must be in place to protect information systems, buildings, and equipment from natural and environmental hazards. a. Technical safeguards b. Organizational safeguards c. Administrative safeguards d. Physical safeguards

d. Physical safeguards, p309

Malware programs that reproduce on their own that have no need for a host application are ______. a. Logic bombs b. Rootkits c. Viruses d. Worms

d. worms p328

Data in Motion

data that are in the process of being transmitted from one location to another location such as an e-mail

Compound Authorization

defined by HIPAA, authorization cannot be extended to include other documents except in clearly defined instances (ie disclosure of PHI for research study can extend to another study)

Designated record set (DRS)

defined by HITEC, group of records maintained by or for a covered entity that is 1) medical records and billing records about individuals 2) enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan 3) used by or for the covered entity to make decisions about individuals

Covered entiity

defined by HITECH, 1) a health plan 2) a healthcare clearing house 3) healthcare provider who transmits any health information in eforms in connection with a transaction covered

Reasonable cause

defined by HITECH, an act or omission in which a covered entity or business associate knew, or by exercising reasonable diligence would have known, that the act or omission violated an administrative simplification provision, but in which the covered entity or business associated did not act with willful neglect

Willful neglect

defined by HITECH, conscious, intentional failure or reckless indifference to the obligation to comply with the administrative simplification provision violated

Authorization

defined by HITECH, covered entity may not use or disclose protected health information without an authorization that is valid

Breach

defined by HITECH, the acquisition, access, use, or discolsure of PHI in a manner not permitted under secuity or privacy rules

Required Standards

defined by HITECH, under Security Rule are implementation specifications which are detailed instructions for implementing a particular standard.

Transfer the risk

outsourcing or insuring the risk against any potential loss to the org.

Bring your own device

personal devices that are allowed to be used within a healthcare organization and interact with electronic protected health information (ePHI)

Stringent

refers to state laws, if state laws exceed federal law standards

Breach Notification Rule

requires covered entities to establish policies and procedures to investigate an unauthorized use or disclosure of PHI to determine if a breach occured and to notify affected individuals and the Dept. of HHS

Residual Risk

risk that remains after no additional controls are implemented

Assessment

systematic collection and review of information pertaining to an individual who wants to receive helathcare services or enter a healthcare setting

Deidentification

the act of removing from a health record or data set any information that could be used to identify the individual to whom the data apply in order to protect his or her confidentiality

Worm

type of computer virus, usually transferred from computer to computer via e-mail, that can replicate itself and use memory but cannot attach itself to other programs (ie, host)

Rootkit

type of malicious software that will remotely access or control a computer without being detected by users or security programs