CHPC PHI Safeguards and Security Questions and Answers

Question 1

A healthcare clinic is relocating to a new facility, and its IT department is moving servers and backup tapes containing ePHI. According to the HIPAA Security Rule's Physical Safeguards, which of the following is a key requirement for managing this process?

Accepted Answer

Maintaining a record of the movement of the hardware and electronic media.

Answer

The HIPAA Security Rule's Physical Safeguards include the Device and Media Controls standard. A specification under this standard requires policies and procedures that govern the movement of hardware and electronic media. While not a 'required' specification, maintaining a record of these movements is a critical part of accountability to ensure ePHI is tracked and protected during transport.

Question 2

A hospital's electronic health record (EHR) system experiences a network outage, preventing clinicians from using their standard credentials. To ensure patient care continues, the organization must have a pre-established method for accessing necessary ePHI. Which HIPAA Security Rule standard specifically addresses this requirement?

Accepted Answer

Emergency Access Procedure

Answer

The HIPAA Security Rule's Technical Safeguards require covered entities to establish (and implement as needed) procedures for obtaining necessary ePHI during an emergency. This is the 'Emergency Access Procedure' standard, which is a required implementation specification under the Access Control standard, designed for situations where normal access methods fail.

Question 3

A Privacy Officer is reviewing the organization's HIPAA Security Rule contingency plan to ensure all required components are present. Which of the following collections of plans MUST be included?

Accepted Answer

A data backup plan, a disaster recovery plan, and an emergency mode operation plan.

Answer

The HIPAA Security Rule's Contingency Plan standard (an Administrative Safeguard) mandates several implementation specifications. Three of these required specifications are a data backup plan, a disaster recovery plan, and an emergency mode operation plan, which are essential for ensuring ePHI is protected and accessible during and after an emergency.

Question 4

A hospital's janitorial staff discards unshredded patient documents containing names, diagnoses, and account numbers into a publicly accessible dumpster. This event constitutes a breach. Which specific safeguard failure is MOST directly responsible for this type of incident?

Accepted Answer

Failure to implement proper policies for the final disposition of PHI.

Answer

Both the HIPAA Privacy and Security Rules require covered entities to implement reasonable safeguards for PHI in any form. This includes having and implementing policies and procedures for the final disposition of PHI, such as shredding or otherwise destroying documents to render them unreadable and unreconstructible before they are discarded.

Question 5

A covered entity is drafting a Business Associate Agreement (BAA) with a new cloud storage vendor. According to HIPAA, which of the following is a mandatory provision that the BAA must contain regarding the business associate's duties?

Accepted Answer

The business associate must implement appropriate administrative, physical, and technical safeguards.

Answer

A compliant Business Associate Agreement must state that the business associate will use appropriate safeguards to prevent the use or disclosure of PHI other than as provided for by the contract. This explicitly includes implementing the requirements of the HIPAA Security Rule (administrative, physical, and technical safeguards) for any ePHI it handles.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC PHI Safeguards and Security Questions and Answers