Healthcare Information Security and Privacy Flashcards

What is the maximum number of days a covered entity has to notify affected individuals after discovering a HIPAA breach?

Answer: 60 days

HIPAA requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Which DICOM attribute must be removed to properly de-identify an image per DICOM PS3.15 standard?

Answer: Patient Name (0010,0010)

Patient Name (0010,0010) is a core identifying attribute that must be removed or anonymized per DICOM de-identification profiles.

A Business Associate Agreement (BAA) is required when a PACS vendor:

Answer: Has access to ePHI while providing services to a covered entity

A BAA is legally required whenever a business associate handles, stores, or transmits ePHI on behalf of a covered entity.

Which type of audit log is most critical for detecting unauthorized access to imaging studies in a PACS environment?

Answer: Access audit log tracking user logins and study views

Access audit logs record who viewed or accessed specific studies and are essential for detecting unauthorized PHI access in PACS.

What does the principle of 'minimum necessary' require in an imaging informatics context?

Answer: Staff should access only the PHI needed to perform their specific job duties

The minimum necessary principle requires limiting PHI access and disclosure to what is reasonably needed to accomplish the intended purpose.

Which federal regulation, beyond HIPAA, governs the cybersecurity posture of healthcare organizations connected to federal networks?

Answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework provides voluntary but widely adopted guidance for managing cybersecurity risk in healthcare beyond HIPAA's requirements.