Combo with "Law Chapter 10 Final Review" and 1 other

A nurse administrator who does not typically take call gets called in over the weekend to staff the emergency department. She does not have access to enter notes since this is not a part of her typical role. In order to meet the intent of the HIPAA Security Rule, the hospital policy should include

a provision to allow her emergency access to the system

If a HIPAA security rule implementation specification is addressable, this means that

an alternative may be implemented...

The capture of data by a hospital's data security system that shows multiple invalid attempts to access the patients' database is an example of what type of security control?

audit trail

One of the four general requirements a covered entity must adhere to for compliance with the HIPAA security rule is to ensure the confidentiality, integrity and ___________ of ePHI.

availability

The HIPAA security rule requires that passwords

be updated by organizational policy

Non-compliance with the HIPAA security rule can lead to

both civil penalties and criminal penalties

The workforce security administrative safeguard requires policies and procedures that

both ensure appropriate ePHI access by workforce members and prevent access to ePHI by workforce members who should not have access

The latest provisions to HIPAA include

breach notification, enforcement and modifications to the privacy and security rules

Which of the following would provide the best support of an organization's efforts toward compliance with the security rule?

build security into software and systems

Copying data onto tapes and storing the tapes at a distant location is an example of

data backup

To ensure compliance with the HIPAA security rule training requirement, the HIIM Director should do which of the following?

determine special needs of HIM staff and provide training

Helpful University Health System has a laptop sharing program which allows users to request laptop computers to use for short-term projects. Many of the projects involve the use of ePHI. When the laptops are returned to the office, they are often immediately recirculated to another user in the system. This is an example of a violation of which of the following aspects of the security rule?

device and media controls

The admissions department is getting some new computers from the surgery department. The director is so excited to get the new computers that he does not contact IT and installs the computers over the weekend in admissions. Since the computers were not checked for the presence of ePHI, the admissions director has violated which provision of the HIPAA security rule?

device and media controls

Which portion of a security program would ensure that ePHI is not stored on recycled equipment?

device and media controls

The HIPAA "Security Awareness and Training" administrative safeguard requires all of the following addressable implementation programs for an entity's workforce except

disaster recovery plan..

What term is also used to denote the HIPAA requirement of Contingency Planning?

emergency mode of operation

The security rule's five sections includes all of the following except:

encryption requirements

Which of the following statements is false about the Security Officer? The Security Officer

holds a required full-time position under HIPAA security rule..

The HIPAA security rule allows flexibility in implementation based on reasonableness and appropriateness. This means that covered entities can

implement based on organizational assessment

The purpose of the implementation specifications of the HIPAA security rule is to provide

instruction for implementation of standards

One of the four general requirements a covered entity must adhere to for compliance with the HIPAA security rule is to ensure the confidentiality, ________, and availability of ePHI.

integrity

Which of the term does the security rule use to define data or information that has not been altered or destroyed in an unauthorized manner?

integrity

Which of the following best describes the role that the HIIM professional should play in HIPAA security compliance?

moderate involvement since the rule is very operational

The HIPAA security rule applies to which of the following covered entities?

A) Hospital that bills Medicare B) Physician electronic billing company C) BlueCross health insurance plan

Assessing HIPAA training programs is important for which of the following reasons?

A) It is how the workforce knows what to do. B) It is highly visible to auditors.

All of the following are security rule physical safeguard standards except

A) facility access controls *** contingency planning*** C) workstation security D) device and media controls

With addressable standards, the covered entity may do all but which of the following?

A) implement the standard as written B) implement an alternative standard *** ignore the standard since it is addressable*** D) determine that the risk of not implementing is negligible

The HIPAA Security Rule allows flexibility in implementation based on reasonableness and appropriateness. What does the covered entity use to make these determinations?

A) size of the covered entity B) security capabilities of the covered entity's system C) costs of security measures

Home health nurses at a covered entity want to use laptop computers to record patient notes. The director of nursing asks for guidance about whether or not this is a HIPAA violation. The most appropriate response from the Security Officer is that they:

need additional training as remote workers

Which of the following is a best practice to comply with the revised security provisions of the HITECH Act?

Inventory BAs to determine which Business Associates Agreements need to be amended.

The HIPAA security rule contains what provision about encryption?

It is required based on organizational policy.

The enforcement agency for the security rule is

Office for Civil Rights

Which of the following statements about HIPAA training is false?

Privacy and security training should be separated.

Some of the best steps that workers can take to comply with the HIPAA security rule include ensuring

the security of mobile devices

A subcontractor of a business associate may

transmit ePHI on the business associate's behalf if it provides satisfactory assurances that the information will be appropriately safeguarded

According to the HIPAA Security Rule, how should a covered entity instruct a physician who needs a new smart phone and her current smart phone contains ePHI?

turn in her old smart phone

Disabling the USB drive on a computer is an example of what type of security?

workstation

What are the primary distinctions between the HIPAA Security Rule and the HIPAA Privacy Rule?

.both The security rule applies to all forms of patients' PHI, whether electronic, written, or oral, but the security rule covers only electronic PHI and the security rule provides for far more comprehensive security requirements than the security rule and includes a level of detail not provided in the security rule..

The best source for obtaining primary information on addressing the HIPAA Security Rule would be which of the following sources?

Department of HHS

The VP of Finance wants to consider sending all of the medical transcriptionists home to work. What security issues should be included in the risk analysis?

access of data by unauthorized persons

Security awareness training programs require the implementation of awareness and training of all workforce members and should include

periodic security reminders

In general, reviews for compliance with various aspects of the security rule should be conducted

periodically

When developing security procedures for remote workforce, the HIM director should reference which of the following?

privacy and security rules, state statutes and other federal statutes

Fred resigned from his position at University Hospital. According to the HIPAA security rule, his access to the electronic health record system should be terminated

promptly upon resignation

The HIPAA security rule requires that the covered entity

protect ePHI from reasonably anticipated threats

The HIPAA security rule contains the following safeguards except

reliability

Dr. Watson is known to chronically not remember his password and ask other physicians and nurses to use their passwords. This is reported by various staff, but the security officer ignores the complaints since Dr. Watson is the chief of staff. The hospital most likely has not complied with which of the following?

sanction policy

When external reviewers request access to electronic patient records, the IT professionals at Charity Clinic determine that giving the reviewers a user name and password to access all records in the database is the quickest and easiest approach. As the HIIM Director, your response to this would be to

suggest records necessary for audit be placed in a queue