PHI Safeguards and Security Flashcards

A healthcare clinic is relocating to a new facility, and its IT department is moving servers and backup tapes containing ePHI. According to the HIPAA Security Rule's Physical Safeguards, which of the following is a key requirement for managing this process?

Answer: Maintaining a record of the movement of the hardware and electronic media.

The HIPAA Security Rule's Physical Safeguards include the Device and Media Controls standard. A specification under this standard requires policies and procedures that govern the movement of hardware and electronic media. While not a 'required' specification, maintaining a record of these movements is a critical part of accountability to ensure ePHI is tracked and protected during transport.

A hospital's electronic health record (EHR) system experiences a network outage, preventing clinicians from using their standard credentials. To ensure patient care continues, the organization must have a pre-established method for accessing necessary ePHI. Which HIPAA Security Rule standard specifically addresses this requirement?

Answer: Emergency Access Procedure

The HIPAA Security Rule's Technical Safeguards require covered entities to establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency. This is the 'Emergency Access Procedure' standard, which is a required implementation specification under the Access Control standard, designed for situations where normal access methods fail.

A Privacy Officer is reviewing the organization's HIPAA Security Rule contingency plan to ensure all required components are present. Which of the following collections of plans MUST be included?

Answer: A data backup plan, a disaster recovery plan, and an emergency mode operation plan.

The HIPAA Security Rule's Contingency Plan standard (an Administrative Safeguard) mandates several implementation specifications. Three of these required specifications are a data backup plan, a disaster recovery plan, and an emergency mode operation plan, which are essential for ensuring ePHI is protected and accessible during and after an emergency.

A hospital's janitorial staff discards unshredded patient documents containing names, diagnoses, and account numbers into a publicly accessible dumpster. This event constitutes a breach. Which specific safeguard failure is MOST directly responsible for this type of incident?

Answer: Failure to implement proper policies for the final disposition of PHI.

Both the HIPAA Privacy and Security Rules require covered entities to implement reasonable safeguards for PHI in any form. This includes having and implementing policies and procedures for the final disposition of PHI, such as shredding or otherwise destroying documents to render them unreadable and unreconstructible before they are discarded.

A covered entity is drafting a Business Associate Agreement (BAA) with a new cloud storage vendor. According to HIPAA, which of the following is a mandatory provision that the BAA must contain regarding the business associate's duties?

Answer: The business associate must implement appropriate administrative, physical, and technical safeguards.

A compliant Business Associate Agreement must state that the business associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by the contract. This explicitly includes implementing the requirements of the HIPAA Security Rule (administrative, physical, and technical safeguards) for any ePHI it handles.

An employee at a physician's office is found to have accessed the medical record of a coworker out of curiosity, with no legitimate job-related reason. This is a clear violation of the organization's privacy policy. Which HIPAA Administrative Safeguard requires the organization to have a formal policy for addressing this employee's misconduct?

Answer: Sanction Policy

The HIPAA Security Rule's Administrative Safeguards require a covered entity to 'Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.' This is a required implementation specification known as the Sanction Policy.