Privacy & Security Flashcards
7 cards from real CMRT practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy & Security flashcards as text
Which federal law specifically protects the confidentiality of substance use disorder treatment records beyond standard HIPAA protections?
Answer: 42 CFR Part 2
42 CFR Part 2 provides heightened confidentiality protections for records of patients treated for substance use disorders at federally assisted programs.
Under the HITECH Act, breach notifications to affected individuals must be sent within:
Answer: 60 days of discovery
HITECH requires covered entities to notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days from discovery.
An EHR audit log is primarily used to:
Answer: Track who accessed, modified, or deleted records and when
Audit logs record access activity, enabling organizations to detect unauthorized access, modifications, or deletions of electronic health records.
A workforce member who accesses a colleague's health record out of curiosity — without a work-related need — is committing:
Answer: A HIPAA privacy violation
Unauthorized access to PHI without a valid work-related reason violates the HIPAA Privacy Rule's minimum necessary and access control requirements.
Which entity is responsible for enforcing HIPAA compliance?
Answer: The Department of Health and Human Services Office for Civil Rights (OCR)
The HHS Office for Civil Rights (OCR) is the primary federal agency that investigates HIPAA complaints and enforces compliance.
Role-based access control (RBAC) in a health information system means:
Answer: System access is granted based on a user's job function, not individual identity
RBAC limits system access to the minimum PHI needed for each staff role, reducing the risk of unauthorized access.
What is 'shoulder surfing' in the context of health information security?
Answer: Viewing a computer screen or document without authorization by looking over someone's shoulder
Shoulder surfing is a physical security threat where an unauthorized person views sensitive information by observing a worker's screen or paper documents.