Confidentiality & Data Security Flashcards

Under HIPAA, which of the following is considered a 'covered entity' with obligations to protect cancer registry data?

Answer: A healthcare provider that transmits health information electronically

Covered entities under HIPAA include health plans, healthcare clearinghouses, and healthcare providers that transmit protected health information electronically.

A cancer registry receives a subpoena requesting identifiable patient records. What is the MOST appropriate first step?

Answer: Notify and consult with the facility's legal counsel before releasing any records

When served with a subpoena, the registrar should consult legal counsel to determine whether the request is valid and whether a court order or patient authorization is required.

Which concept requires that cancer registry employees only access patient data necessary for their specific job functions?

Answer: Need-to-know principle

The need-to-know principle restricts access to confidential information to only those individuals whose job duties require it.

A tumor registrar discovers that a coworker has been accessing patient records for cases outside their assigned abstracting workload. This MOST likely violates which policy?

Answer: Minimum necessary use provisions

Accessing more patient information than is necessary for one's duties violates the HIPAA minimum necessary standard.

When a cancer registry shares data with an external researcher under a data use agreement, the DUA must specify which of the following?

Answer: Permitted uses of the data and required safeguards

A data use agreement must define the permitted uses and disclosures of the limited data set and required safeguards to protect it.

Which of the following best describes a 'limited data set' as defined by HIPAA?

Answer: Data that excludes most direct identifiers but may retain dates and geographic information below state level

A limited data set removes most direct identifiers but may include dates (e.g., admission, discharge, birth) and geographic subdivisions smaller than a state.

A cancer registry manager receives a request from a life insurance company asking for a patient's cancer history to assess a policy application. The CORRECT response is to:

Answer: Require a signed, valid patient authorization before releasing any information

Disclosure to a life insurance company requires the patient's valid written authorization because this is not a treatment, payment, or healthcare operations purpose.