Confidentiality & Data Security Flashcards

A registrar is conducting a virtual meeting and shares their screen, which displays an open case with patient identifiers. This MOST likely violates which HIPAA safeguard category?

Answer: Administrative safeguards

Policies and procedures governing how employees handle and display PHI during meetings fall under administrative safeguards.

A researcher requests identified cancer data from a state registry but does not have IRB approval. The registry should:

Answer: Deny the request until proper IRB approval or waiver documentation is provided

Research using identifiable cancer registry data generally requires IRB approval or a formal waiver; the registry should not provide the data without it.

Which of the following elements, if included in a dataset, would PREVENT it from meeting HIPAA Safe Harbor de-identification standards?

Answer: Five-digit ZIP code for a population under 20,000

Under Safe Harbor, geographic units smaller than a state must be suppressed if the area has fewer than 20,000 people; a full 5-digit ZIP code in such an area is a prohibited identifier.

Which professional organization publishes standards of ethics and confidentiality guidelines that CTRs are expected to follow?

Answer: The National Cancer Registrars Association (NCRA)

The NCRA publishes a Code of Ethics that includes professional standards for maintaining patient confidentiality in cancer registry practice.

A cancer registry is transitioning from paper-based to electronic abstracting. To comply with HIPAA, paper records containing PHI that are no longer needed must be:

Answer: Disposed of by shredding, burning, or pulping to render the PHI unreadable

HIPAA requires that PHI in paper form be disposed of in a manner that renders the information unreadable, indecipherable, and unable to be reconstructed.

A state health department asks a hospital cancer registry for a monthly data file to fulfill mandatory reporting requirements. This disclosure is permissible PRIMARILY because:

Answer: State mandatory reporting laws create a HIPAA-permitted public health disclosure exception

HIPAA permits covered entities to disclose PHI to public health authorities authorized by law to collect such data for public health surveillance and reporting.

Which of the following passwords would be considered MOST secure for a cancer registry database account according to current best practices?

Answer: Tr@8#mK!29vLqZ

Strong passwords use a mix of uppercase, lowercase, numbers, and special characters and are not based on dictionary words or predictable patterns.