Healthcare Information Security and Privacy Flashcards

Under HIPAA, which of the following is considered Protected Health Information (PHI) in a radiology context?

Answer: Patient name combined with a radiological diagnosis

PHI includes any individually identifiable health information, such as a patient name linked to a diagnosis or imaging study.

Which HIPAA rule specifically governs the technical safeguards for electronic PHI stored in PACS?

Answer: HIPAA Security Rule

The HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (ePHI), including systems like PACS.

A radiology technologist accidentally emails a patient's MRI report to the wrong recipient. Under HIPAA, this is classified as a:

Answer: Breach of unsecured PHI

An accidental disclosure of unsecured PHI to an unauthorized recipient meets the definition of a HIPAA breach requiring notification.

Which encryption standard is recommended by NIST for protecting ePHI at rest in imaging systems?

Answer: AES-256

AES-256 (Advanced Encryption Standard with 256-bit keys) is the NIST-recommended standard for encrypting ePHI at rest.

In the context of imaging informatics, what is the primary purpose of role-based access control (RBAC)?

Answer: Ensure users can only access PHI necessary for their job function

RBAC restricts system access based on a user's organizational role, enforcing the minimum necessary standard for PHI access.

Which of the following is a required element of a HIPAA Security Rule risk analysis for an imaging department?

Answer: Identifying potential threats and vulnerabilities to ePHI

A risk analysis must identify potential threats and vulnerabilities to ePHI as a foundational requirement of the HIPAA Security Rule.