CPCA Medical Records and HIPAA Privacy Flashcards
6 cards from real CPCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CPCA Medical Records and HIPAA Privacy flashcards as text
What is a HIPAA breach as defined under the Breach Notification Rule?
Answer: An impermissible use or disclosure of PHI that compromises its security or privacy
A HIPAA breach is an impermissible acquisition, access, use, or disclosure of PHI that is presumed to compromise its privacy unless exceptions apply.
How soon must a covered entity notify affected individuals after discovering a PHI breach?
Answer: Within 30 days
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay, and no later than 60 days after discovery, but the standard practice is within 30 days.
When must a HIPAA breach affecting 500 or more individuals be reported to the HHS Secretary?
Answer: Within 60 days of discovery
Large breaches affecting 500 or more individuals must be reported to the HHS Secretary promptly and no later than 60 days after discovery.
A patient asks a dermatology practice to amend an entry in their medical record they believe is incorrect. What is the practice required to do?
Answer: Review the request and respond within 60 days, accepting or denying with written explanation
HIPAA gives patients the right to request amendments, and covered entities must respond within 60 days, providing written denial reasons if applicable.
What is the purpose of a HIPAA Risk Analysis?
Answer: To identify potential vulnerabilities and threats to ePHI
HIPAA's Security Rule requires covered entities to conduct a risk analysis to identify threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI.
Which of the following is an example of de-identified health information under HIPAA?
Answer: A data set with all 18 HIPAA identifiers removed
De-identified information has had all 18 HIPAA identifiers removed or undergone statistical expert determination that re-identification risk is very small.