RHIT Exam Prep Chp. 11

the patient has requested an amendment to her health record, The facility, after review with the physician, has decided to deny the request. According to HIPAA, the patient must be notified within how many days?

60

The facility had a security breach. The breach was identified on 10/10/16. The investigation was completed on 10/15/16. What is the deadline that the notification must be completed?

60 days from 10/10/16

Which of the following is an example of a security incident?

A hacker accessed PHI from off site

Which of the following is an example of a trigger that might be used to reduce auditing?

A patient and user have the same last name

The admin states that he should not have to participate in privacy and security training as he does not use PHI. How should you respond?

All employees are required to participate in the training, including top administration

When logging into a system, you are instructed to enter a string of characters. These characters appear distorted onscreen, however. What kind of access control is this?

CAPTCHA

The police came to the HIM dept. and asked that a patient's right to an accounting of disclosure be suspended for two months. What is the proper response to this request?

Certainly officer, we will be glad to do that as soon as we have that request in writing.

HIPAA states that release to a coroner is allowed. State law says that the coroner must provide a subpoena. Which of the following is a correct statement?

Follow the state law since it's stricter

Miles has asked you to explain the rights he has via HIPAA privacy standards. Which of the following is one of his HIPAA-given rights?

He can ask to be contacted at an alternate site

The clinic has decided to use mobile technology. Identify the best practice for this technology?

Identify who owns the mobile device

Mary processed a request for information and mailed it out last week. The requestor called and said that not all of the information was received. Mary talked to her supervisor about this with the requestor believing more information is still needed. Given the above information, which of the following statements is true?

Mary is not required to release the extra documentation because the facility has the right to interpret a request and apply the minimum standard rule.

Which of the following statements demonstrates a violation of PHI?

Mary, at work yesterday I saw Susan had a hysterectomy

Mountain hospital has discovered a security breach. someone hacked into the system and viewed 50 medical records. According to ARRA, what is the responsibility of the covered entity in a reasonable time not to exceed 60 days?

Notify the patient

Which of the following set(s) is an appropriate use of the emergency accede procedure?

One nurse is at lunch and the covering nurse needs patient information AND a patient is crashing and the attending is not in the hospital so a helping physician is available

A doctor's office has requested PHI for continued care. The ROI clerk wants to limit the information provided because of the minimum necessary tule. What should the supervisor tell the clerk?

Patient care is an exception to the minimum necessary rule, so process the request as written

Which of the following is a true statement about private key encryption?

Public encryption uses a private and public key

Which of the following would be a business associate?

ROI company

Which of the following situations violates a patient's privacy?

The hospital provides patients names and addresses to a pharmaceutical company to be used in a mass mailing for free drug samples.

The patient calls and has a telephone consultation. Which of the following is true about notice of privacy practices?

The notice of privacy practices can be mailed to the patient

The physician office you go to has a data integrity issue. What does this mean?

There has been unauthorized alteration of patient information

A nurse has been flagged for review because she logged into the EHR in the evening when she usually works the day shift. Why should this conduct be reviewed?

This needs to be investigated before a decision is made because there may be a legitimate reason why she logged in at this time.

You have been given some information that includes the patient's account number. Which statement is true?

This not de-identified information, because it is possible to identify the patient

A patient signed an authorization to release information to a physician but decided not to go to the physician. Can he stop the release?

Yes, as long as it has not been released already

Nancy has asked the health care facility for a copy of her grandmother's health record. Her grandmother died 20 years ago. Nancy is not the executor of the estate, and she does not want to ask her aunt for permission. Select the appropriate response to Nancy.

You cannot access your grandmother's privacy, as she has the right of privacy for 50 years after her death

Which of the following examples is an exception to the definition of breach?

a coder accidently sends PHI to a billing clerk in the same facility

to which of the following requesters can a facility release information about a patient without that patient's authorization?

a court with a court order

Someone accessed the covered entity's EHR and sold the information that was accessed. This person is known as which of the following?

a cracker

Researchers can access patient information if it is

a limited data set

When patients are able to obtain a copy of their health record, this is an example of which of the following?

a patient right

You have been asked to create a presentation on intentional and unintentional threats. Which of the following should be included in the list of threats you cite?

a patient's SSN being used for credit card applications

the supervisors have decided to give nursing staff access to the EHR. They can add notes, view, and print. This is an example of what?

a workforce clearance procedure

The company's policy states that audit logs, access reports, and security incident reports should be reviewed daily. This review is known as

an information system activity review

Before a user is allowed to access PHI, the system confirms that this is a valid user. This is known as

authentication

Which of the following is the term used to identify who made an entry into a health record?

authorship

You have been asked to provide examples of technical security measures. Which of the following would you include in your list of examples?

automatic logout

Three components of a data security program are protecting the privacy of data, ensuring the integrity of data, and ensuring the

availability of data

Which security measure utilizes fingerprints or retina scans?

biometrics

In case your system crashes, your facility has defined the policies and procedures necessary to keep your business going. This is known as

business continuity plan.

The computer system containing the EHR was located in a room that was flooded. As a result, the system is inoperable. Which of the following would be implemented?

business continuity processes

The HIPAA security rule impacts which of the following PHI?

clinical data repository

You are a nurse who works on 3West during the day shift. One day, you had to work the night shift because they were shorthanded. However, you were unable to access the EHR. What type of access controls are being used?

context-based

Alisa has trouble remembering her password. She is trying to come up with a solution that will help her remember. Which one of the following would be the best practice?

creating a password that utilized a combo of letters and numbers.

In a recent review, it was determined that the EHR is essential to the operations of the home health agency. What type of review is this?

criticality analysis

Your organization is sending confidential patient information across the internet using technology that will transform the original data into unintelligible code that can be re-created by authorized users. This technique is called:

data encryption

You have been asked to give an example of secure information. Which of the following will you give as your answer?

data is encrypted which makes it unreadable

Which of the following can be released without consent or authorization?

de-identified health information

You have been given the responsibility of destroying the PHI contained in the system's old server before it is trashed. What destruction method do you recommend?

degaussing

Our website was attacked by malware that overloaded it. What type of malware was this?

denial of service

As chief privacy officer for Premier Medical Center, you are responsible for which of the following?

developing a plan for reporting privacy complaints

What type of digital signature uses encryption?

digital signature

Contingency planning includes which of the following processes?

disaster planning

You are defining the designated record set for south beach healthcare center. which of the following would be included?

discharge summary

The patient has the right to agree or object in which of the following situations?

disclosing information to family member who is directly involved in care.

A hacker recently accessed our database. We are trying to determine how the hacker got through the firewall and exactly what was accessed. The process used to gather this evidence is called

forensics

A certification agency validates the use of encryption between two organization's website. How do they validate it ?

hypertext markup language

An employee in the admission dept stole the patient's name, SSN, and other information and used it to get a charge card in the patient's name. This is an example of

identity theft

The fair and accurate credit transactions act works to reduce

identity theft

The surgeon comes out to speak to a patient's family. He tells them that the patient came through the surgery fine. The man was benign and they could see the patient in an hour. He talks low so the other people in the waiting room will not hear but someone walked by and heard.This is called a(n)

incidental disclosure

A covered entity:

includes health care providers who performs specified actions electronically

PHI includes

individually identifiable health information in any format stored by a health care provider or business associate

A mechanism to ensure that PHI has not been altered or destroyed inappropriately has been established. This process is called?

integrity

The information system has just notified you that someone has attempted to access the system inappropriately. This process is known as?

intrusion detection

Which of the following statements is true about the privacy act of 1974?

it applies to the federal government

John is a 45y male who is mentally unstable. Who can authorize release of his health record?

legal guardian

Which of the following is an example of administrative safeguards under the security rule?

monitoring the computer access activity of the user

I have been asked if I want to be in the directory. The admission clerk explains that if I am in the directory,

my friends and family can find out my room number

Intrusion detection systems analyze

network traffic

The purpose of the notice of privacy practices is to

notify the patient of uses of PHI

An effective monitoring program contains which of the following?

outlining how employees suspected of a breach will be confronted

Which of the following is an example of two-factor authentication?

password and token

Which of the following is allowed by HIPAA?

permitting a spouse to pick up medication for the patient

The HIM director received an email from the technology support services dept about her email being full and asking for her password. The director contacted tech support and it was confirmed that their dept did not send this email. This is an example of what type of malware?

phishing

The physician office has set the information systems so that they will log out after 5 minutes of inactivity. This is an example of which of the following?

physician safeguard

In conducting an environmental risk assessment, which of the following would be considered in the assessment?

placement of water pipes in the facility

HIPAA allows health care providers to charge patients reasonable cost-based charges. Which of the following is allowed when determining the charge?

preparing a summary

The patient has the right to control access to his or her health information. This is known as

privacy

Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely

psychotherapy notes

To prevent their network from going down, a company has duplicated much of its hardware and cables. This duplication is called

redundancy

Which of the following disclosures would require patient authorization?

release to patient's family

Which of the following situations would require authorization before disclosing PHI?

releasing information to the Bureau of Disability Determination

You are looking for potential problems and violations of the privacy rule. What is this security management process called?

risk assessment

you are reviewing your privacy and security policies, procedures, training program, and so on, and comparing them to the HIPAA and ARRA regulations. You are conducting a

risk assessment

You have to determine how likely a threat will occur. What is this assessment known as?

risk determination

Kyle, the HIM director, has received a request to amend a patient's health record. The appropriate action for him to take is

route the request to the physician who wrote the note in question to determine appropriateness of the amendment

You are conducting research on what you need to do to comply with HIPAA. You are afraid that you will have to implement all of the steps tat your friend at a 900-bed teaching hospital is implementing at his facility. You continue reading and learn that you only have to implement what is prudent and reasonable for your facility. This is called?

scalable

Which of the following documents is subject to the HIPAA security rule?

scanned operative report stored on CD

You have to decide which type of firewall you want to use in your facility. Which of the following is one of your options?

secure socket layer

You work for an organization that publishes a health information management journal and provides clearinghouse services. What must you do?

separate the e-PHI form the non covered entity portion of the organization

The info systems dept. was performing their routine destruction of data that they do every year. Unfortunately they accidently deleted a record that is involved in a medical malpractice case. This unintentional destruction of evidence is called?

spoliation

Before we can go any further with our risk analysis, we need to determine what systems/information needs to be protected. This step is known as

system characterization

Bob submitted his resignation from Coastal Hospital. His last day is today, he should no longer have access to the EHR and other systems as of 5pm. The removal of his privileges is known as

terminating access

A home health care agency employee has contacted the CMS to report health care fraud. Patient information is provided in the report. Which of the following is true?

the disclosure is not a violation of HIPAA if the information was provided in good faith

Which statement is true about when a family member can be provided with PHI?

the family member is directly involved in the patient's care

Which of the following should the record destruction program include?

the method of destruction

Breach notification is required unless:

the probability of PHI being compromised is low

John is allowed to delete patients in the EHR. Florence is not. They both have the same role in the organization. Whaat is different?

their permissions

Critique this statement: a business associate has the right to use a health care facility's information beyond the scope of their agreement with the health care facility.

this is a false statement because it is prohibited by the HIPAA privacy rule.

As chief privacy officer, you have been asked why you are conducting a risk assessment. Which reason would you give?

to prevent breach of confidentiality

Which of the following is an example of an administrative safeguard?

training

Critique this statement: security training must be face to face

training can use many different methods

An employee was recently caught accessing his wife's health record. The system automatically notified the staff of potential breach due to the same last name for the user and the patient. This was an example of a

trigger

The research coordinator viewed 10 patients records for a research study being conducted. Select the term used for this practice.

use

The data on a hard drive were erased by a corrupted file that had been attached to an email message. Which of the following can be used to prevent this?

virus checker

Before an employee can be given access to the EHR someone has to determine what the employee is allowed to have access to. What is this known as?

workforce clearance procedure

You have been assigned the responsibility of performing an audit to confirm that all of the workforce's access is appropriate for their role in the organization. This process is called

workforce clearance procedure

Your dept was unable to provide a patient with a copy of his record within the 30-day limitation. What should you do?

write the patient and let them know that you will need a 30-day extension

If an authorization is missing a SSN, can it be valid

yes