CPHIMS Healthcare Privacy and Security Flashcards

Under HIPAA, which of the following is NOT considered protected health information (PHI)?

Answer: De-identified health data meeting Safe Harbor standards

De-identified health data that meets HIPAA's Safe Harbor or Expert Determination standards is not considered PHI and is not subject to HIPAA protections.

A healthcare organization experiences a ransomware attack that encrypts patient records. Under HIPAA Breach Notification Rule, when must affected individuals be notified?

Answer: Within 60 days of discovery

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach.

Which NIST framework component focuses on recovering systems and services after a cybersecurity incident?

Answer: Recover

The NIST Cybersecurity Framework 'Recover' function focuses on restoring capabilities and services impaired by a cybersecurity incident.

An employee accesses patient records of a celebrity out of curiosity without a treatment purpose. This is an example of which type of HIPAA violation?

Answer: Unauthorized access (snooping)

Accessing patient records without a legitimate treatment, payment, or operations purpose is considered unauthorized access or 'snooping,' a serious HIPAA violation.

What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

Answer: To ensure vendors safeguard PHI they access on behalf of a covered entity

A BAA is a contract that requires business associates to appropriately safeguard PHI they create, receive, maintain, or transmit on behalf of a covered entity.

Which access control model assigns permissions based on a user's role within an organization rather than individual identity?

Answer: Role-Based Access Control (RBAC)

Role-Based Access Control (RBAC) grants permissions based on organizational roles, making it the most widely used model in healthcare IT systems.

Under the HIPAA Privacy Rule, a patient's right to request an amendment to their health record applies when:

Answer: The record contains information the patient believes is inaccurate or incomplete

Patients have the right to request amendments to their PHI if they believe information in their record is incorrect or incomplete, though the covered entity may deny the request.