Mixed Deck — All CHPC Topics Flashcards

A Privacy Officer is evaluating the organization's training program and notices that while annual training is conducted, there is no ongoing reinforcement. Which action would most effectively create a continuous culture of awareness?

Answer: Implementing periodic security reminders, such as posters, newsletter articles, and simulated phishing emails.

An effective awareness program is continuous, not a single annual event. The HIPAA Security Rule includes 'Security Reminders' as an addressable implementation specification. Using periodic reminders, simulated phishing exercises, and other forms of ongoing communication helps keep security and privacy top-of-mind and fosters a stronger culture of awareness than a single, longer training session would.

A hospital's Privacy Officer receives a verbal complaint from a patient who believes their PHI was impermissibly shared. What is the most appropriate FIRST step the Privacy Officer or their designee should take in handling this complaint?

Answer: Ask the patient to submit the complaint in writing and begin an internal investigation.

Standard procedure for handling patient complaints is to take them seriously, document them, and conduct a thorough internal investigation. It is a best practice to ask the patient to submit the complaint in writing to ensure clarity and proper documentation before taking further action like reporting or disciplinary measures.

Which scenario does NOT require a Business Associate Agreement?

Answer: A U.S. Postal Service carrier that incidentally delivers paper PHI on behalf of a covered entity

HIPAA explicitly exempts transmission-only entities like the USPS from the business associate definition when they are not accessing PHI content.

What happens to a BAA if the underlying covered entity–business associate relationship ends?

Answer: The BA must return or destroy all PHI and confirm compliance to the covered entity

Upon termination of the relationship, the business associate must return or destroy all PHI and certify that no copies have been retained, unless retention is legally required.

If an internal investigation uncovers a significant compliance violation, which of the following steps should occur?

Answer: Implement corrective actions to address the violation

When a significant compliance violation is uncovered, the most critical immediate step is to implement corrective actions. These actions directly address the identified violation, aiming to stop the non-compliant behavior, remediate any harm, and prevent its recurrence. This demonstrates the organization's commitment to resolving issues and maintaining compliance, forming the foundation for further steps like reporting or retraining.

Under HIPAA, psychotherapy notes receive special protection. Which statement best describes this?

Answer: They require a separate, specific authorization from the patient for most disclosures

Psychotherapy notes are separately defined and require a specific patient authorization for most disclosures, beyond the general authorization used for other PHI.

If a covered entity denies a patient's amendment request, what must the entity provide?

Answer: Written denial with the basis and information about filing a statement of disagreement

When denying an amendment, the covered entity must provide a written denial that includes the basis for denial and the patient's right to submit a statement of disagreement.

Which right allows patients to receive a list of disclosures of their PHI made by a covered entity in the past six years?

Answer: Right of accounting of disclosures

The HIPAA right of accounting of disclosures allows individuals to request a log of certain PHI disclosures made without their authorization.

Which of the following is a mandatory component that must be included in a HIPAA Business Associate Agreement (BAA)?

Answer: A provision requiring the business associate to make its internal practices available to the Secretary of HHS for compliance determination.

A compliant Business Associate Agreement must include several key elements, one of which is establishing that the business associate will make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary of the Department of Health and Human Services (HHS) to determine compliance with HIPAA. While insurance and fee schedules are good business practices, they are not explicitly required elements of a BAA by HIPAA.

Which of the following is a permitted use of PHI by a business associate WITHOUT requiring additional patient authorization?

Answer: Using PHI for the specific services described in the BAA with the covered entity

A business associate may only use or disclose PHI as permitted by its BAA with the covered entity or as required by law.

A hospital's electronic health record (EHR) system experiences a network outage, preventing clinicians from using their standard credentials. To ensure patient care continues, the organization must have a pre-established method for accessing necessary ePHI. Which HIPAA Security Rule standard specifically addresses this requirement?

Answer: Emergency Access Procedure

The HIPAA Security Rule's Technical Safeguards require covered entities to establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency. This is the 'Emergency Access Procedure' standard, which is a required implementation specification under the Access Control standard, designed for situations where normal access methods fail.

A healthcare organization is implementing a new electronic health record (EHR) system. Which of the following is the MOST critical initial step in managing the privacy implications of this new system?

Answer: Conducting a comprehensive Privacy Impact Assessment (PIA).

A Privacy Impact Assessment (PIA) is a foundational tool used to identify and mitigate privacy risks associated with new systems or processes that handle Protected Health Information (PHI). It should be conducted early in the project lifecycle to ensure that privacy considerations are built into the system design ('Privacy by Design'), rather than being addressed after implementation. While training, updating notices, and signing a BAA are all crucial components of privacy program management, the PIA is the most critical *initial* step to understand and address potential privacy risks proactively.

A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?

Answer: A brief description of the steps individuals should take to protect themselves from potential harm.

The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.

A Privacy Officer is reviewing the organization's HIPAA Security Rule contingency plan to ensure all required components are present. Which of the following collections of plans MUST be included?

Answer: A data backup plan, a disaster recovery plan, and an emergency mode operation plan.

The HIPAA Security Rule's Contingency Plan standard (an Administrative Safeguard) mandates several implementation specifications. Three of these required specifications are a data backup plan, a disaster recovery plan, and an emergency mode operation plan, which are essential for ensuring ePHI is protected and accessible during and after an emergency.

Which of the following entities is considered a business associate under HIPAA?

Answer: A cloud service provider that stores PHI for a covered entity

Cloud service providers that store or process PHI on behalf of covered entities are business associates and require a BAA.

An employee at a physician's office is found to have accessed the medical record of a coworker out of curiosity, with no legitimate job-related reason. This is a clear violation of the organization's privacy policy. Which HIPAA Administrative Safeguard requires the organization to have a formal policy for addressing this employee's misconduct?

Answer: Sanction Policy

The HIPAA Security Rule's Administrative Safeguards require a covered entity to 'Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity.' This is a required implementation specification known as the Sanction Policy.

What is the role of auditing and monitoring in a healthcare compliance program?

Answer: To evaluate the effectiveness of the compliance program and detect non-compliance

Auditing and monitoring are critical components of a compliance program designed to regularly assess whether the program is functioning as intended. These activities help identify weaknesses, detect instances of non-compliance, and ensure that policies and procedures are being followed. This allows for timely corrective actions and continuous improvement of the compliance program's effectiveness.

Which statement MOST accurately describes de-identified health information under HIPAA?

Answer: De-identified data is not subject to the HIPAA Privacy Rule and may be freely used and disclosed

Once properly de-identified under HIPAA standards, the information is no longer PHI and falls entirely outside the Privacy Rule's scope, including minimum necessary, authorization, and NPP requirements.

A covered entity wishes to send promotional materials to its former patients about a new, non-health-related service, such as a financial planning workshop hosted by a third party. Under the HIPAA Privacy Rule, which of the following is required before using PHI for this purpose?

Answer: A valid, written authorization from each individual.

Using or disclosing PHI for marketing purposes generally requires a specific, written authorization from the individual. This authorization must be in plain language and clearly state how the information will be used. Communications about third-party products or services that involve remuneration are considered marketing and are not covered under treatment, payment, or healthcare operations exceptions.

The NIST Privacy Framework is designed to help organizations manage privacy risk. It is distinct from but complementary to cybersecurity frameworks. What is a primary focus of the NIST Privacy Framework?

Answer: Managing risks arising from authorized data processing activities, such as collection, use, and disclosure.

The NIST Privacy Framework is a tool for managing privacy risks throughout the entire data lifecycle. A key distinction is its focus on risks arising from authorized data processing (i.e., how data is collected, stored, used, and shared), not just from unauthorized access or security breaches. It helps organizations build patient trust by managing data ethically and in predictable ways.