Confidentiality & Data Security Flashcards

A CTR receives an email from an unknown sender requesting a list of patients diagnosed with leukemia for a 'national study.' What is the BEST course of action?

Answer: Forward the request to the privacy officer and do not respond directly

Unsolicited data requests from unknown parties should be escalated to the privacy officer, who can verify legitimacy and determine the appropriate response.

Which of the following is an example of a technical safeguard required under the HIPAA Security Rule for electronic cancer registry data?

Answer: Implementing audit controls that record access to electronic PHI

Audit controls are a technical safeguard under the HIPAA Security Rule that record and examine activity in systems containing electronic PHI.

Data suppression in cancer registry statistical reports is PRIMARILY used to:

Answer: Prevent the identification of individuals when cell counts are very small

Suppression hides statistics for cells with small counts (often fewer than 16 cases) to prevent indirect re-identification of specific patients.

A cancer registry uses a third-party cloud storage vendor to back up patient data. According to HIPAA, this vendor must sign which type of agreement?

Answer: A business associate agreement (BAA)

Any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate and must sign a BAA.

An employee leaves a cancer registry position. Which action is the MOST important immediate step from a data security standpoint?

Answer: Revoking the employee's system access and returning all data access credentials

Immediately revoking system access upon termination is critical to prevent unauthorized post-employment access to PHI.

Which of the following BEST describes the purpose of an Institutional Review Board (IRB) in relation to cancer registry research?

Answer: To review and approve research protocols to protect the rights and welfare of human subjects

An IRB reviews research protocols involving human subjects to ensure ethical standards are met and participant rights are protected before data are shared.

A cancer registrar accidentally sends a report containing patient identifiers to the wrong email address. Under HIPAA, this event is INITIALLY classified as:

Answer: A potential breach requiring a risk assessment to determine reportability

A misdirected email containing PHI is presumed to be a reportable breach unless a risk assessment demonstrates a low probability that the PHI was compromised.