CHP HITECH Act & Electronic Health Records Compliance 3

Question 1

What does the 'minimum necessary' standard require under HIPAA and HITECH?

Accepted Answer

Only the minimum amount of PHI needed to accomplish the intended purpose should be used, disclosed, or requested

Answer

Covered entities must maintain the minimum number of EHR systems to reduce risk exposure

Answer

Business associates must retain only the minimum records required by their contracts

Answer

Covered entities must provide regulators with only the minimum documentation requested

Question 2

Under HITECH, what expanded accounting of disclosures right applies specifically to electronic health records?

Accepted Answer

Patients may request a list of all individuals who accessed their EHR for treatment, payment, and operations purposes

Answer

Covered entities must disclose all EHR access logs to state health departments quarterly

Answer

Business associates must send patients monthly summaries of all PHI disclosures

Answer

Patients can opt out of any EHR disclosure except for emergency treatment

Question 3

The Medicare and Medicaid EHR Incentive Programs created under HITECH are now referred to by which name?

Accepted Answer

Promoting Interoperability Programs

Answer

Health IT Achievement Program

Answer

Electronic Care Quality Initiative

Answer

Digital Health Advancement Program

Question 4

Under HITECH, what is the role of the Office for Civil Rights (OCR) in relation to HIPAA enforcement?

Accepted Answer

Investigating HIPAA complaints, conducting audits, and imposing civil monetary penalties

Answer

Developing and maintaining EHR certification criteria and standards

Answer

Managing financial incentive payments for EHR adoption by eligible providers

Answer

Overseeing the operation of state-level health information exchanges

Question 5

A covered entity discovers a breach on March 5th. What is the latest date by which affected individuals must be notified?

Accepted Answer

May 4th (60 days later)

Answer

April 4th (30 days later)

Answer

April 19th (45 days later)

Answer

June 3rd (90 days later)

Question 6

Which HITECH provision most directly addressed the gap that previously exempted business associates from direct HIPAA liability?

Accepted Answer

The direct applicability of Security Rule requirements to business associates

Answer

The Meaningful Use incentive provisions

Answer

The EHR certification criteria established by ONC

Answer

The tiered penalty structure for covered entity violations

Question 7

Under the HITECH Act, what constitutes 'unsecured PHI' for purposes of the breach notification rule?

Accepted Answer

PHI that has not been rendered unusable, unreadable, or indecipherable through encryption or destruction per HHS guidance

Answer

Any PHI stored on a mobile device regardless of encryption status

Answer

PHI shared via email without a digital signature

Answer

Any PHI held by a business associate rather than a covered entity