Regulatory Compliance & Standards Flashcards

Under the HITECH Act, which entity type became directly liable for HIPAA compliance for the first time?

Answer: Business associates

HITECH (2009) extended direct HIPAA liability to business associates, who were previously only bound through contracts with covered entities.

Which CMS program requires eligible professionals to report quality measures through an EHR to avoid a payment adjustment?

Answer: MACRA/MIPS

MACRA established MIPS, which requires clinicians to report quality, cost, and improvement activity data—often through certified EHRs—to avoid negative Medicare payment adjustments.

A hospital shares de-identified patient data with a research university. Under HIPAA, which standard must the data meet to be considered truly de-identified?

Answer: Expert determination or Safe Harbor method

HIPAA recognizes two de-identification methods: the Expert Determination method and the Safe Harbor method, which requires removal of 18 specific identifiers.

Which federal regulation mandates that EHR systems support electronic prescribing of controlled substances (EPCS)?

Answer: DEA 21 CFR Part 1311

The DEA's 21 CFR Part 1311 (2010) established the federal framework permitting and regulating electronic prescribing of controlled substances.

What is the maximum penalty per violation category per year under HIPAA's tiered civil monetary penalty structure?

Answer: $1,500,000

HIPAA's tiered penalty structure caps annual penalties at $1,500,000 per violation category, regardless of the number of individual violations in that category.

Which standard governs the electronic exchange of clinical documents, including discharge summaries and progress notes, in a structured format?

Answer: HL7 CDA (Clinical Document Architecture)

HL7 Clinical Document Architecture (CDA) is the XML-based standard for structuring and exchanging clinical documents such as discharge summaries.

Under the 21st Century Cures Act's information blocking rules, which actor is NOT subject to information blocking prohibitions?

Answer: Individual clinicians not using certified EHRs

The information blocking rule applies to health IT developers, HIEs/HINs, and healthcare providers—individual clinicians using non-certified systems are not enumerated actors under the rule.