CHPS Privacy Program Management 2

Question 1

Under HIPAA, a covered entity's Privacy Officer receives a complaint from a patient who believes their PHI was improperly disclosed. What is the FIRST action the Privacy Officer should take?

Accepted Answer

Acknowledge the complaint and initiate an investigation according to the complaint management process

Answer

File the complaint with OCR on the patient's behalf

Answer

Dismiss the complaint if the patient cannot name the specific workforce member involved

Answer

Immediately notify the patient's insurer of the potential disclosure

Question 2

A healthcare organization implements a 'Privacy by Design' approach. Which principle best describes this concept?

Accepted Answer

Integrating privacy protections into the design and architecture of systems from the outset

Answer

Retroactively reviewing systems for privacy risks after deployment

Answer

Designating a privacy champion in each department

Answer

Publishing a comprehensive privacy policy annually

Question 3

Which of the following BEST describes the concept of 'data minimization' in healthcare privacy program management?

Accepted Answer

Collecting and using only the minimum PHI necessary to accomplish the intended purpose

Answer

Deleting all PHI after 30 days regardless of retention requirements

Answer

Limiting access to PHI to only the Privacy Officer and Security Officer

Answer

Reducing the number of systems that store PHI to fewer than three

Question 4

A healthcare organization wants to share a patient's case study in a medical journal. Which is the MOST appropriate privacy approach?

Accepted Answer

De-identify the information to Safe Harbor standards before publication

Answer

Obtain verbal consent from the patient prior to submission

Answer

Share the case study since medical education is a permitted TPO purpose

Answer

File an IRB waiver of authorization for research purposes

Question 5

Which of the following best describes the role of a Privacy Steering Committee in a healthcare organization?

Accepted Answer

A cross-functional body that provides governance, oversight, and strategic direction for the privacy program

Answer

A committee that reviews and approves individual patient access requests

Answer

A team that investigates all workforce privacy violations

Answer

A group that reviews BAAs before execution

Question 6

Under a comprehensive privacy program, which document maps the flow of PHI through an organization to identify privacy risks?

Accepted Answer

Data Flow Diagram or Data Map

Answer

Business Associate Agreement

Answer

Notice of Privacy Practices

Answer

Risk Assessment Report