Security & Risk Management Flashcards

Under the HIPAA Security Rule, which type of safeguard includes conducting a risk analysis and designating a security official?

Answer: Administrative safeguards

Risk analysis, risk management, and assigning security responsibility are required administrative safeguards under 45 CFR 164.308.

A facility wants to identify how a new medication-dispensing process might fail before it goes live. Which tool is most appropriate?

Answer: Failure mode and effects analysis (FMEA)

FMEA is a proactive tool that identifies potential failure modes and their effects before harm occurs.

Under the HIPAA Breach Notification Rule, a breach affecting 500 or more residents of a state requires notification to whom in addition to affected individuals and HHS?

Answer: Prominent media outlets serving the state

Breaches involving more than 500 residents of a state or jurisdiction require notice to prominent media outlets serving that area.

Which risk management strategy is used when an organization purchases professional liability insurance?

Answer: Risk transfer

Buying insurance shifts the financial consequences of a loss to a third party, which is risk transfer.

Which encryption-related statement about ePHI under the HIPAA Security Rule is correct?

Answer: Encryption is an addressable implementation specification

Encryption is addressable, meaning the entity must implement it or document why an equivalent alternative is reasonable and appropriate.

A near miss is best defined as:

Answer: An error that was caught before reaching the patient

A near miss is an event or error that did not reach the patient, often due to chance or timely intervention.

Which OSHA standard requires a written exposure control plan for employees who may contact blood?

Answer: Bloodborne Pathogens Standard

OSHA's Bloodborne Pathogens Standard (29 CFR 1910.1030) requires a written exposure control plan reviewed at least annually.