Health Information Privacy & Security Mod 1

The patient is an exception to the minimum necessary rule, so process the request as written.

A patient has submitted an authorization to release information to physician office for continued care. The release of information clerk wants to limit the information provided because of the minimum necessary rule. What should the supervisor tell the clerk?

identity theft

An employee in the admission department took the patient's name, social security number, and other information and used it to get charge card in the patient's name. This is an example of :

Developing a plan for reporting privacy complaints

As Chief Privacy Officer for Premier Medical Center, you are responsible for which of the following?

authentication

Before a user is allowed to access protected health information, the system confirms that the patient is who he or she says they are. This is known as:

disaster planning

Contingency planning includes which of the following processes?

my friends and family can find out my room number

I have been asked if I want to be in the directory. The admission clerk explains that I am in the directory

route the request to the physician who wrote the note in question to determine appropriateness of the amendment.

Kyle, the HIM director, has received a request to amend a patient's medical record. The appropriate action for him to take is

Mary is not required to release extra documentation because the facility has the right to interpret a request and apply the minimum standard rule

Mary processed a request of information and mailed it out last week. Today, the requestor, an attorney called and said that all of the requested information was not provided. Mary pulls the documentation, including the authorization and what was sent. She believes that she sent everything that was required based on what was requested. The requestor still believes that some extra documentation is required. Given the above information, which of the following statements is true?

All individuals must be notified within 60 days

Mountain Hospital has discovered a security breach. Someone hacked into the system and viewed 50 medical records. According to ARRA, what is the responsibility of the covered entity?

2 and 3 only

Physical safeguards include 1. tools to monitor access 2. TOOLS TO CONTROL ACCESS TO COMPUTER SYSTEMS 3. FIRE PROTECTION 4.tools preventing unauthorized access to data

Include the documents from the other hospital

Patricia is processing a request for medical records. The record contains an operative note and a discharge summary for another hospital. The records are going to another physician for patient care. What should Patricia do?

De-identified health information

Which of the following can be released without consent or authorization

*Privacy*

The patient has the right to control access to his or her health information. This is known as :

release to patient's family

Which of the following disclosures would require patient authorization?

ARRA mandates that a CE must comply with a requested restriction unless it meets one of the exceptions.

Which of the following statement is true about a requested restriction?

It applies to the federal government

Which of the following statements is true about the Privacy Act of 1974?

1 and 4

Which of the following techniques would a facility employ for access control? 1. automatic logoff 2. authentication 3. integrity controls 4. unique user identification

The hospital provides patient names and address to a pharmaceutical company to be used in a mass mailing for free drug samples

Which of the following violates a patient's privacy?

risk assessment

You are reviewing your privacy and security policies, procedures, training programs,and so on, and comparing them to HIPAA and ARRA regulations. You are conducting a

Write the patient and tell him that you will need a 30-day extension.

Your department was unable to provide a patient with a copy of his record within the 30-day limitation. What should you do?