Certified in Healthcare Privacy and Security Flashcards

Which of the following HIPAA standards would contain the policies and procedures that specify the process for authorizing access to PHI?

Answer: Access authorization

Policies and procedures that define the process for granting access to protected health information (PHI) are typically addressed in the "Access Authorization" standard of the Health Insurance Portability and Accountability Act (HIPAA). Access authorization refers to the controls and mechanisms put in place to ensure that only authorized individuals can access PHI. The Access Authorization standard under HIPAA includes requirements for covered entities (such as healthcare providers, health plans, and healthcare clearinghouses) to implement policies and procedures that govern the granting and revoking of access to PHI. These policies and procedures should specify who can access PHI, under what circumstances, and for what purposes. They also typically outline the processes for reviewing and approving access requests, ensuring appropriate user authentication and authorization, and maintaining audit trails to track access to PHI.

Which of the following rules outlines the steps in implementing several policies and processes to safeguard the security of credit, debit, and cash card transactions?

Answer: Payment Card Industry Data Security Standard (PCD DDS)

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established by the major credit card companies (Visa, Mastercard, American Express, Discover, and JCB International) to ensure the protection of cardholder data. PCI DSS specifies a series of policies and procedures that organizations handling credit, debit, and cash card transactions must implement to safeguard cardholder information.

No later than 60 days from the date of discovery, written notice of a breach must be sent to each individual.

Answer: First class mail or e-mail

According to the HIPAA Breach Notification Rule, covered entities are required to provide written notification to individuals whose protected health information (PHI) has been breached. The notification must be completed without unreasonable delay, but no later than 60 days from the date of discovery of the breach. Regarding the method of notification, the rule does not specify a particular means of communication. However, it states that covered entities should use the individual's preferred method of contact if that information is available. First-class mail and email are commonly used methods for delivering breach notifications. The choice between these methods depends on the contact information available for the affected individuals and their indicated preferences.

What kind of threat is equipment theft?

Answer: Acts of man

The theft of equipment is considered an example of a threat known as "acts of man" or "human threats." Acts of man refer to intentional or deliberate actions carried out by individuals that pose a risk to the security and safety of assets, information, or systems.

How long after someone passes away does medical information cease to be safeguarded by HIPAA rules and is no longer deemed protected health information?

Answer: 50

Under the HIPAA Privacy Rule, a deceased person's health information stops being protected health information 50 years after death. The dated options and 'waiver' are distractors—HIPAA defines a fixed 50-year period, not a specific calendar date or a waiver-based condition.

An organization has just implemented a new policy that spells out how it would physically safeguard the five clinics it owns. This is an illustration of a (n)

Answer: Facility security plan

The implementation of a new policy that outlines how an organization protects the physical space of its clinics is an example of a Facility Security Plan. A Facility Security Plan is a comprehensive set of policies, procedures, and protocols designed to safeguard the physical security of an organization's facilities. It covers various aspects such as access control, surveillance systems, visitor management, emergency response, incident reporting, and other security measures.

An example of a policy that details the tasks that may be carried out on computers and laptops inside an organization

Answer: Workstation use

Workstation Use is the HIPAA Security Rule physical safeguard standard that requires policies specifying the proper functions, manner of performance, and physical environment for devices that access ePHI. Risk avoidance is a risk-management strategy, not a usage policy, and exclusion and security update do not define what tasks may be performed on workstations.