250 4

Ace your homework & exams now with Quizwiz!

The HIPAA-recognized consent is a patient's agreement to

Use or disclosure for TPO purposes

Jenny is completing an unpaid summer internship in the corporate compliance office of a CareNet, a for-profit organization that purchases and oversees physician practices. Jenny is a:

Workforce member

If a HIPAA security rule implementation specification is addressable, this means that

an alternative may be implemented...

waived authorization in a research study

approved by the Institutional Review Board or Privacy Board

The capture of data by a hospital's data security system that shows multiple invalid attempts to access the patients' database is an example of what type of security control?

audit trail

One of the four general requirements a covered entity must adhere to for compliance with the HIPAA security rule is to ensure the confidentiality, integrity and ___________ of ePHI.

availability

Terry has requested that all written communications from his cardiologist's office be sent to his work address instead of his home address. The cardiology practice__________.

b. Is not required to honor any confidential communication requests of this nature

Which of the following statements is true? A HIPAA authorization __________.

b. May be revoked as long as it is in writing.

If Sheri requests a copy of her health record from a provider, per HIPAA the provider

b. May charge for the cost of copying

HealthPartners has been the target of a network server hacking incident. 300 patients were affected. HealthPartners__________.

b. Must inform the patients of what occurred; the type of PHI involved; and what steps HealthPartners is taking to prevent future hacking incidents

Non-compliance with the HIPAA security rule can lead to

both civil penalties and criminal penalties

Charlie went to the HIM department at Langford Hospital to request an amendment to his PHI. The HIM staff required that he make the request in writing. He said this violated his HIPAA rights. Who is correct?

d. The HIM department, because the Privacy Rule allows covered entities to require amendment requests be made in writing

General Hospital has denied Crystal's request to access her medical record. The denial is not subject to appeal. Which of the following is the most likely reason for the denial?

d. The PHI contains psychotherapy notes

Copying data onto tapes and storing the tapes at a distant location is an example of

data backup

The HIPAA "Security Awareness and Training" administrative safeguard requires all of the following addressable implementation programs for an entity's workforce except

disaster recovery plan..

What term is also used to denote the HIPAA requirement of Contingency Planning?

emergency mode of operation

preemption

federal law supersedes state law if federal and state laws conflict

Which of the following statements is false about the Security Officer? The Security Officer

holds a required full-time position under HIPAA security rule..

What is availability?

A requirement intended to ensure that systems work promptly and service is not denied to authorized users.

What is data integrity?

A requirement that information and programs are changed only in a specified and authorized manner. System integrity is a requirement that a system performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system.

What is confidentiality?

A requirement that private or confidential information not be disclosed to unauthorized individuals.

The purpose of the implementation specifications of the HIPAA security rule is to provide

instruction for implementation of standards

immunization records

may be disclosed by pediatricians if requested verbally by the patient's parents

restriction requests

must be followed if disclosure would be to a health plan for payment and the PHI pertains to a service or item paid for in full by someone other than the health plan

state-mandated report of sexually transmitted disease

must be included in patient accounting of disclosures

The HIPAA security rule applies to which of the following covered entities?

A) Hospital that bills Medicare B) Physician electronic billing company C) BlueCross health insurance plan

IF A HIPPA SECURITY RULE IMPLEMENTATION SPECIFICATIONS IS ADDRESSABLE, THIS MEANS THAT:

AN ALTERNATIVE MAY BE IMPLEMENTED

While covered entity is legally responsible for their employees, they are not responsible for their actions of business visitors (True/False)

False

THE HIPPA SECURITY RULE APPLIES TO WHICH OF THE FOLLOWING COVERED ENTITIES?

HOSPITAL THAT BILLS MEDICARE; PHYSICIAN ELECTRONIC BILLING COMPANY; BLUE CROSS HEALTH INSURANCE PLAN

One of the medical staff committees at St. Vincent Hospital is responsible for reviewing cases of patients readmitted within 14 days after discharge. This review of the patients' medical records is __________.

Healthcare operations

THE PURPOSE OF THE IMPLEMENTATION SPECIFICATIONS OF THE HIPAA SECURITY RULE IS TO PROVIDE

INSTRUCTION FOR IMPLEMENTATION OF STANDARDS

What is Security?

It is protecting information from loss, unauthorized access or misuse, and keeping in confidential

The enforcement agency for the security rule is

Office for Civil Rights

Which of the following statements about HIPAA training is false?

Privacy and security training should be separated.

General Rule #2 is:

Protecting against any anticipated threats or hazards to the security

General Rule #3 is:

Protecting against reasonably anticipated unauthorized uses or disclosures

copy of health record

the provider may charge for the cost of copying

12-month period

the time period in which a covered entity must provide the first accounting of disclosures at no cost

1. The HIPAA privacy rule __________.

Sets a minimum (floor) of privacy requirements

You are a member of the hospital's health information management committee. The committee has created a HIPAA-complaint authorization form. Which of the following items would you advise the committee to remove, as the privacy rule not require it?

Signature of the patient's attending physician

THE GOAL OF THE SECURITY RULE IS TO ENSURE THAT PATIENT INFORMATION IS PROTECTED FROM UNAUTHORIZED ACCESS, ALTERATION, DELETION, AND TRANSMISSION

TRUE

THE SECURITY RULE CONTAINS BOTH REQUIRED AND ADDRESSABLE STANDARDS

TRUE

What does HIPAA Administrative Simplification include?

--PHI --ePHI --Security Rule --Privacy Rule

Computer System Security:

--The need for ready access to patient information by those involved in patient care

Computer System Security:

--The need to protect against unauthorized access and loss of critical health inforamtion

What are the primary distinctions between the HIPAA Security Rule and the HIPAA Privacy Rule?

.both The security rule applies to all forms of patients' PHI, whether electronic, written, or oral, but the security rule covers only electronic PHI and the security rule provides for far more comprehensive security requirements than the security rule and includes a level of detail not provided in the security rule..

WHAT ARE THE PRIMARY DISTINCTIONS BETWEEN THE HIPPA SECURITY RULE AND THE HIPPA PRIVACY RULE?

1 -THE PRIVACY RULE APPLIES TO ALL FORMS OF PATIENT'S PHI, WHETHER ELECTRONIC, WRITTEN, OR ORAL, BUT THE SECURITY RULE COVERS ONLY THE ELECTRONIC PHI; 2 - THE SECURITY RULE PROVIDES FOR FAR MORE COMPREHENSIVE SECURITY REQUIREMENTS THAN THE PRIVACY RULE AND INCLUDES A LEVEL OF DETAIL NOT PROVIDED IN THE PRIVACY RULE.

The HIPAA privacy rule __________.

Both a and b are incorrect

General Rule #1 is:

Confidentiality, integrity, and availability of all e-PHI they create, receive,maintain, or transmit

_______changes readable text into a series of "garbed" characters that scramble data before it is transmitted

Encryption

CE'S CAN DECIDE TO APPLY WITH ONLY THE PRIVACY RULE AND DON'T HAVE TO COMPLY WITH THE SECURITY RULE

FALSE

CENTERS FOR MEDICARE & MEDICAID SERVICES (CMS) IS THE ENFORCEMENT AGENCY FOR THE SECURITY RULE

FALSE

ONLY HC PROVIDERS ARE REQUIRED TO COMPLY WITH THE SECURITY RULE

FALSE

THE CONDITION OF PARTICIPATION RESTRICT PAYMENT TO PROVIDERS WHO ARE NOT COMPLIANT WITH THE SECURITY RULE

FALSE

THE SECURITY RULE CONTAINS ENCRYPTION SPECIFICATIONS THAT ALL CE'S MUST COMPLY

FALSE

THE SECURITY RULE CONTAINS PROVISIONS THAT CE'S CAN IGNORE

FALSE

THE SECURITY RULE IS COMPLETELY TECHNICAL AND REQUIRES COMPUTERS PROGRAMMERS TO ADDRESS

FALSE

THE SECURITY RULE REQUIRES CE'S TO ENSURE THE INTEGRITY OF PATIENT INFO

FALSE

A covered entity is not responsible for the HIPAA training of staff. This is the responsibility of the individual employee (True/False)

False

Access Privilege is what allows an individual to enter a computer system for authorized purpose (True/False)

False

Each covered entity must have a Security Officer in addition to the HIPAA Officer (True/False)

False

Physical Safeguards include policies and management of employees and their passwords and access codes (True/False)

False

Administrative Safeguards are the policies or the required management of employees in relation to protection of patient information (True/False)

True

It currently takes an experienced hacker less than a minute to guess any combination of four character password (True/False)

True

The Security Rule requires protection of health information when being transmitted (True/False)

True

An original goal of HIPAA Administrative Simplification was to standardize __________.

The electronic transmission of health data

Access is defined as:

The exposure necessary to read, write, modify, or communicate data and information

Champion Hospital retains Hall, Hall, and Hall, a law firm, to perform all of its legal work, including representation during medical malpractice lawsuits. Which of the following statement(s) is (are) correct?

The law firm is not a business associate because it is a legal, not a medical, organization. b. The law firm is a business associate because it performs activities on behalf of the hospital.

Technical Safeguards include:

The security of the computer server, hubs, switches, connecting wires, terminals and desk units in which protected health information (PHI) is stored accessed, or transmitted

How are HIPAA's Security Rule standards?

The standards are essentially technology neutral

30 days

The time allowed for a physician's office to respond to requests for copies of health records

What is another thing that a provider can be liable for?

They can also be liable for privacy and security breaches that result from permitting access to EHRs by unauthorized personnel or from inadequately safeguarding the EHR from destruction

What can a provider be liable for?

They can be liable if records are so highly guarded that information is not readily available to those treating a patient

What does flexibility and scalability of the standards do?

They make it possible for all CEs, regardless of size, to be compliant with the rules

What do covered entities use under HIPAA Privacy Rule?

They may use any security methods that enable them "to reasonably and appropriately implement" the security standards of the rule

How are HIPAA Security Standards unique?

They state fairly general objectives, but provide no detailed instructions concerning how to meet them

What does the Privacy Rule govern?

This governs the privacy and confidentiality of all PHI, regardless of medium

What does the Security Rule govern?

This only governs the PHI transmitted by or maintained in some form of electronic media

requirements for covered entity to issue a denial for a request amendment

a) a description of how the individual may complain to the covered entity, b) the basis for the denial, c) a statement that the individual may submit a written disagreement

Which of the following is not required when a covered entity issues a denial of a requested amendment?

a. A pre-printed form on which the individual may dispute the denial

Kyle likes to request frequent accounting of disclosure reports from all of his providers so he knows where his PHI is being disseminated.

a. Each covered entity must provide the first accounting within a 12-month period at no cost

Comparing HIPAA to the Federal Privacy Act of 1974, __________.

a. HIPAA applies more specifically to medical information

Mercy Hospital personnel need to review the medical records of Katie Grace for utilization review purposes (#1). They will also be sending her records to her physician for continuity of care (#2). As they pertain to Mercy Hospital, these two functions are:

a. Use (#1) and disclosure (#2)

Privacy Rule

allows covered entities to require amendment requests be made in writing

The minimum necessary standard __________.

c. Applies to both uses and disclosures of PHI

Emma is getting ready to begin kindergarten. Her school is requesting her immunization records, as required by state law. Per HIPAA, Emma's pediatrician may__________.

c. Disclose this PHI with verbal permission from Emma's parent

Gwen's PHI was erroneously recorded on another person's voicemail. Regarding an accounting of disclosures, this disclosure__________.

c. Has to be included even though it was an oral communication

Of the following options, a sign-in sheet at a physician's office is best described as __________.

c. Incidental disclosure

According to the January 2013 Final Rule, an impermissible use or disclosure__________.

c. Is presumed to be a breach unless a low probability of compromise is demonstrated

Restriction requests__________.

c. Must be followed if disclosure would be to a health plan for payment and the PHI pertains to a service or item paid for in full by someone other than the health plan

Today, Janet Kim visited her new dentist for an appointment. She was not presented with a Notice of Privacy Practices. Is this acceptable?

c. No. It is a violation of the HIPAA Privacy Rule.

1. Sally Mitchell was treated for kidney stones at Graham Hospital last year. She now wishes to review her medical record in person. She has requested to review them by herself in a closed room. Which of the following is true?

c. Sally's request does not have to be granted because the hospital is responsible for the integrity of the medical record.

Barbara requested a copy of her PHI from her physician office on August 31. It is now October 10 and she has not heard anything from the physician office. Which of the following statements is correct?

c. This is a HIPAA violation because the physician's office did not respond within 30 days.

Which of the following is not required to be included in an accounting of disclosures?

d. Disclosure to the health department reporting the birth of Shelly's son

incident report

not part of the designated record set

opting out of facility directory

only the patient's general condition and acknowledgment of admission are given to callers

denial of access to medical records

psychotherapy patients can be denied access to their medical records

The HIPAA security rule contains the following safeguards except

reliability

healthcare facility

responsible for the integrity of the health record

January 2013 Final Rule

states that impermissible use or disclosure is presumed to be a breach unless a low probability of compromise is demonstrated


Related study sets

Exam 2: Native American Experience

View Set

Seizure/Sensory Perception ATI Q&A ***

View Set