Healthcare Information Security and Privacy Flashcards

In imaging informatics, which network security measure prevents unauthorized DICOM queries from external sources?

Answer: Application Entity (AE) title whitelisting

AE title whitelisting restricts DICOM communication to approved, pre-registered devices by verifying the calling and called AE titles.

What is the recommended approach for securing DICOM transmissions over a public or untrusted network?

Answer: TLS-encrypted DICOM or VPN tunneling

DICOM over TLS (Secure DICOM) or VPN tunneling encrypts data in transit, protecting ePHI from interception on untrusted networks.

Which scenario triggers mandatory reporting to HHS under HIPAA's Breach Notification Rule?

Answer: A breach affecting 500 or more individuals in a state

Breaches affecting 500 or more individuals in a state require notification to HHS and prominent media outlets, in addition to individual notifications.

What is the purpose of a 'data use agreement' in the context of sharing de-identified imaging data for research?

Answer: Governs how limited datasets with some identifiers can be used by researchers

A data use agreement permits sharing of limited datasets (retaining some identifiers like dates) for research under specified use restrictions.

Which physical safeguard under HIPAA is most relevant to securing PACS workstation access in a radiology reading room?

Answer: Workstation use policies and automatic screen locks

Workstation use policies and automatic screen locks are HIPAA physical safeguards that prevent unauthorized viewing of ePHI on unattended terminals.

In a multi-site radiology network, which security practice ensures that a compromised site cannot spread malware to PACS across the entire enterprise?

Answer: Network segmentation with firewalls between sites

Network segmentation isolates each site's systems, preventing lateral movement of malware and containing breaches to a single segment.