CHPC Privacy Auditing and Monitoring — Questions and Answers
Question 1: Which statement best describes the difference between compliance monitoring and compliance auditing in a healthcare privacy program?
- Monitoring is ongoing and usually done by operational staff, while auditing is a formal, periodic review done by people independent of the process (Correct answer)
- Monitoring is done only by outside regulators, while auditing is done only by internal staff
- Monitoring and auditing are the same activity under different names
- Auditing is ongoing and informal, while monitoring is a once-a-year formal review
Correct answer: Monitoring is ongoing and usually done by operational staff, while auditing is a formal, periodic review done by people independent of the process
Monitoring is the routine, ongoing checking that operational managers do day to day. Auditing is a more formal, structured review done periodically by people independent of the area being reviewed, such as internal audit, the compliance office or an outside firm. A mature privacy program needs both.
Question 2: Which HIPAA Security Rule standard requires hardware, software and/or procedural mechanisms that record and examine activity in information systems containing ePHI?
- Integrity controls
- Audit controls (Correct answer)
- Person or entity authentication
- Transmission security
Correct answer: Audit controls
45 CFR 164.312(b), Audit Controls, is a technical safeguard. It requires mechanisms that record and examine activity in systems containing ePHI. Access-log reviews used to catch snooping rely on this standard.
Question 3: A privacy officer wants to catch workforce members viewing records without a work-related reason. Which monitoring activity is MOST effective?
- Asking staff to confirm once a year that they have never snooped
- Reviewing the Notice of Privacy Practices every year
- Proactive EHR access-log reviews, such as same-last-name, VIP and coworker record checks (Correct answer)
- Raising the minimum password length
Correct answer: Proactive EHR access-log reviews, such as same-last-name, VIP and coworker record checks
Proactive access-log monitoring, often supported by automated analytics, flags patterns such as employees opening records of family members, coworkers, neighbors or VIP patients. Self-attestations and password rules do not detect inappropriate access that has already happened.
Question 4: When building an annual privacy audit work plan, what should mainly drive the choice of areas to audit?
- Whichever departments had the fewest complaints last year
- A risk assessment that ranks areas by likelihood and impact of privacy violations, plus OIG/OCR enforcement priorities (Correct answer)
- Alphabetical rotation through departments
- Only areas where the auditor has personal expertise
Correct answer: A risk assessment that ranks areas by likelihood and impact of privacy violations, plus OIG/OCR enforcement priorities
A risk-based work plan puts limited audit resources on the areas with the highest likelihood and impact of noncompliance. It draws on the organization's risk assessment, past incidents and complaints, and current regulator focus such as OCR enforcement trends.
Question 5: What is the main purpose of a baseline audit when a privacy program is first set up or a new process is introduced?
- To impose discipline on employees right away
- To measure current performance so later audits can track improvement (Correct answer)
- To replace the need for a risk analysis
- To satisfy the breach notification rule
Correct answer: To measure current performance so later audits can track improvement
A baseline audit records the current state of compliance. Later audits are compared against it to show whether corrective actions and program changes are actually improving results.
Question 6: An audit finds that 30% of sampled release-of-information requests were processed without a valid authorization. What is the MOST appropriate next step?
- File the audit report and take no further action until next year's audit
- Find the root cause, carry out a corrective action plan, assess whether any disclosures were reportable breaches, and re-audit to confirm the fix (Correct answer)
- Fire the entire release-of-information staff
- Delete the audit findings to limit liability
Correct answer: Find the root cause, carry out a corrective action plan, assess whether any disclosures were reportable breaches, and re-audit to confirm the fix
Audit findings should lead to root-cause analysis, a documented corrective action plan (training, process changes, sanctions where appropriate), a breach risk assessment for the improper disclosures, and a follow-up audit to confirm the fix worked.
