Privacy Program Management Flashcards

A covered entity must mitigate harmful effects of a known privacy violation. Which action BEST reflects the mitigation standard?

Answer: Retrieving misdirected PHI and obtaining assurances from the recipient that it was destroyed

Section 164.530(f) requires mitigation, to the extent practicable, of harmful effects, such as retrieving or securing improperly disclosed PHI.

For a breach affecting 500 or more residents of a single state, which notification is required in addition to individual and HHS notice?

Answer: Notice to prominent media outlets serving that state or jurisdiction

The Breach Notification Rule requires media notice when a breach involves more than 500 residents of a state or jurisdiction.

Which program element addresses federal confidentiality rules for substance use disorder treatment records that may exceed HIPAA requirements?

Answer: 42 CFR Part 2 compliance

42 CFR Part 2 governs confidentiality of federally assisted SUD program records and imposes requirements beyond HIPAA.

Which of the following must a covered entity document about privacy complaints it receives?

Answer: All complaints received and their disposition, if any

Section 164.530(d)(2) requires documenting all complaints received and their disposition.

A privacy officer is building a data inventory as a program foundation. What is its PRIMARY value?

Answer: It identifies where PHI resides, how it flows, and who accesses it, enabling risk-based controls

A data inventory and flow map shows PHI locations and movements, which drives risk assessment and control placement.

Under the Breach Notification Rule, who bears the burden of proof that a required notification was made or that an impermissible use was not a breach?

Answer: The covered entity or business associate

Section 164.414 places the burden of demonstrating compliance on the covered entity or business associate.

Which approach BEST ensures privacy is considered when a hospital implements a new patient-facing mobile app?

Answer: Conduct a privacy impact assessment during design and procurement, applying privacy by design

A privacy impact assessment during design embeds privacy controls before deployment instead of fixing problems afterward.