Mixed Deck — All CHPS Topics Flashcards

Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Answer: De-identified health data meeting the Safe Harbor standard

Data that meets the Safe Harbor de-identification standard (removing 18 specified identifiers) is no longer PHI and is not subject to HIPAA protections.

The Workforce Security standard under the HIPAA Security Rule's Administrative Safeguards requires covered entities to:

Answer: Implement policies and procedures to ensure that workforce members have appropriate access to ePHI and to prevent those who do not have access from obtaining it

Workforce Security requires policies ensuring appropriate ePHI access for those who need it while preventing unauthorized access by those who do not, covering authorization, supervision, and termination procedures.

What is the HIPAA standard for de-identification using the Expert Determination method?

Answer: A qualified statistical expert determines the risk of identifying an individual is very small

Expert Determination requires a qualified statistical or scientific expert to certify that the risk of re-identification is very small using generally accepted principles.

What does the Evaluation standard under the HIPAA Security Rule's Administrative Safeguards require a covered entity to perform?

Answer: Periodic technical and non-technical evaluations of the security policies and procedures in response to environmental or operational changes

The Evaluation standard requires covered entities to periodically assess how well their security policies and procedures meet the Security Rule requirements, particularly after operational or environmental changes.

Under HIPAA, which of the following is considered a 'hybrid entity'?

Answer: An organization that performs both covered and non-covered functions

A hybrid entity is an organization that performs both HIPAA-covered healthcare functions and non-covered functions and has designated its health care components accordingly.

A hospital's privacy program is undergoing an external assessment. Which standard would be MOST appropriate for benchmarking privacy program maturity in a US healthcare context?

Answer: NIST Privacy Framework (PF)

The NIST Privacy Framework (PF) provides a voluntary, risk-based framework for managing privacy risks that aligns well with US healthcare privacy requirements including HIPAA.

Under HIPAA, which term describes a vendor that provides services to a covered entity and creates, receives, maintains, or transmits PHI in the course of providing those services?

Answer: Business Associate

A business associate is a person or entity that performs services for a covered entity involving the use or disclosure of PHI, and must sign a Business Associate Agreement.

A patient requests an amendment to their medical record because they believe information is incorrect. Under HIPAA, the covered entity may deny the request if:

Answer: The record was not created by the covered entity

A covered entity may deny an amendment request if the PHI was not created by that entity, among other permissible reasons.

Which of the following situations falls under the minimal standards?

Answer: Disclosures for business associates activities

The minimum necessary requirements apply to the scenario of "disclosures for business associates' activities." Under the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the minimum necessary standard requires covered entities (such as healthcare providers, health plans, and healthcare clearinghouses) to make reasonable efforts to limit the use, disclosure, or request of protected health information (PHI) to the minimum necessary to accomplish the intended purpose.

How does the HIPAA Security Rule define electronic protected health information (ePHI)?

Answer: Individually identifiable health information that is created, received, maintained, or transmitted in electronic form

ePHI is individually identifiable health information that a covered entity creates, receives, maintains, or transmits in electronic form, covering all electronic media, not just internet transmissions.

In healthcare cybersecurity, what does the term 'patch management' refer to?

Answer: The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities

Patch management is the structured process of keeping software current with security and functional updates to remediate known vulnerabilities before they are exploited.

A covered entity receives a subpoena for a patient's medical records. Under HIPAA, the covered entity may disclose PHI in response to the subpoena only if:

Answer: Satisfactory assurances are received that the patient was notified or a protective order is in place

HIPAA permits disclosure in response to a subpoena without a court order only when the covered entity receives satisfactory assurances that the individual was notified or that a qualified protective order is in place.

When a business associate discovers a breach of PHI, within what timeframe must it notify the covered entity?

Answer: Without unreasonable delay and within 60 days of discovery

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days following discovery.

Which of the following access control models is most commonly recommended for healthcare environments to enforce least privilege?

Answer: Role-Based Access Control (RBAC)

RBAC grants access based on a user's job role, which aligns well with the least-privilege principle in healthcare settings.

Under the HIPAA Breach Notification Rule, what is the presumption when an impermissible use or disclosure of PHI occurs?

Answer: The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise

Under the 2013 Omnibus Rule, an impermissible use or disclosure is presumed to be a breach unless a covered entity can demonstrate through a four-factor risk assessment that there is a low probability the PHI was compromised.

What is the key difference between the HIPAA Privacy Rule and the HIPAA Security Rule?

Answer: The Privacy Rule covers all PHI in any form; the Security Rule covers only electronic PHI (ePHI)

The Privacy Rule applies to protected health information in all forms (oral, paper, electronic), while the Security Rule specifically addresses electronic PHI (ePHI).

After three unsuccessful log-in attempts in three minutes, a system is programmed to lock a user out. This is an illustration of

Answer: Log-in monitoring

Log-in monitoring refers to the practice of tracking and analyzing log-in attempts to detect and respond to suspicious or unauthorized activities related to user authentication. It involves monitoring and analyzing log-in events, such as successful and unsuccessful log-in attempts, to identify patterns or anomalies that may indicate potential security threats or breaches.

Which of the following is an example of a technical safeguard under the HIPAA Security Rule?

Answer: Role-based access control limiting ePHI access by job function

Role-based access control is a technical safeguard — it uses technology to ensure workforce members access only the ePHI necessary for their job functions.

When a breach affects 500 or more residents of a state or jurisdiction, a covered entity must notify which additional party?

Answer: Prominent media outlets serving the state or jurisdiction

When a breach affects 500 or more residents of a state, the covered entity must provide notice to prominent media outlets in addition to individual and HHS notification.

Which of the following is considered a permissible purpose for using or disclosing PHI without patient authorization under the HIPAA Privacy Rule?

Answer: Public health activities such as disease reporting

Public health activities, including reporting diseases to public health authorities, are a permissible use of PHI under 45 CFR §164.512(b).