Certified in Healthcare Privacy and Security Flashcards

Under HIPAA, which of the following is considered a 'hybrid entity'?

Answer: An organization that performs both covered and non-covered functions

A hybrid entity is an organization that performs both HIPAA-covered healthcare functions and non-covered functions and has designated its health care components accordingly.

Which NIST framework publication provides guidance specifically for protecting health information in cybersecurity programs?

Answer: NIST SP 800-66

NIST SP 800-66 is the resource guide for implementing the HIPAA Security Rule and provides practical guidance for healthcare organizations.

A patient requests an amendment to their medical record because they believe information is incorrect. Under HIPAA, the covered entity may deny the request if:

Answer: The record was not created by the covered entity

A covered entity may deny an amendment request if the PHI was not created by that entity, among other permissible reasons.

What is the primary purpose of a Data Use Agreement (DUA) under HIPAA?

Answer: To permit use of a limited data set by a recipient for specific purposes

A DUA is required when a covered entity shares a limited data set (with most direct identifiers removed) with a recipient for research, public health, or health care operations.

Under the HIPAA Breach Notification Rule, what is the maximum number of days a covered entity has to notify affected individuals of a breach?

Answer: 60 days

Covered entities must notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days after discovery.

Which of the following access control models is most commonly recommended for healthcare environments to enforce least privilege?

Answer: Role-Based Access Control (RBAC)

RBAC grants access based on a user's job role, which aligns well with the least-privilege principle in healthcare settings.

A covered entity discovers a breach affecting 600 residents of a single state. In addition to notifying individuals, the entity must:

Answer: Notify the Secretary of HHS within 60 days and notify prominent media outlets in the state

For breaches affecting more than 500 residents of a state or jurisdiction, the covered entity must notify HHS and prominent media outlets in that state within 60 days.