CTR Confidentiality & Data Security 2

Question 1

Under HIPAA, which of the following is considered a 'covered entity' with obligations to protect cancer registry data?

Accepted Answer

A healthcare provider that transmits health information electronically

Answer

Covered entities under HIPAA include health plans, healthcare clearinghouses, and healthcare providers that transmit protected health information electronically.

Question 2

A cancer registry receives a subpoena requesting identifiable patient records. What is the MOST appropriate first step?

Accepted Answer

Notify and consult with the facility's legal counsel before releasing any records

Answer

When served with a subpoena, the registrar should consult legal counsel to determine whether the request is valid and whether a court order or patient authorization is required.

Question 3

Which concept requires that cancer registry employees only access patient data necessary for their specific job functions?

Accepted Answer

Need-to-know principle

Answer

The need-to-know principle restricts access to confidential information to only those individuals whose job duties require it.

Question 4

A tumor registrar discovers that a coworker has been accessing patient records for cases outside their assigned abstracting workload. This MOST likely violates which policy?

Accepted Answer

Minimum necessary use provisions

Answer

Accessing more patient information than is necessary for one's duties violates the HIPAA minimum necessary standard.

Question 5

When a cancer registry shares data with an external researcher under a data use agreement, the DUA must specify which of the following?

Accepted Answer

Permitted uses of the data and required safeguards

Answer

A data use agreement must define the permitted uses and disclosures of the limited data set and required safeguards to protect it.

(CTR) Certified Tumor Registrar Practice Test

(CTR) Certified Tumor Registrar Practice Test

CTR Confidentiality & Data Security 2