Regulatory Compliance & Standards Flashcards

Which organization is responsible for certifying EHR technology under the ONC Health IT Certification Program?

Answer: Accredited Testing Laboratories (ATLs) and ONC-ACBs

ONC-Authorized Certification Bodies (ONC-ACBs) working with ONC-Authorized Testing Laboratories (ATLs) perform EHR certification under the ONC program.

A breach affecting 600 patients must be reported to HHS and patients within how many days under HIPAA?

Answer: Within 60 days of discovery

HIPAA requires covered entities to notify affected individuals and HHS within 60 days of discovering a breach affecting 500 or more individuals, or fewer.

The Minimum Necessary Standard under HIPAA requires covered entities to:

Answer: Limit PHI access and disclosure to the least amount needed for the intended purpose

The Minimum Necessary Standard requires that access to, use of, and disclosures of PHI be limited to the minimum amount necessary to accomplish the intended purpose.

Which terminology standard is required by ONC for recording problems/diagnoses in a certified EHR?

Answer: ICD-10-CM

ONC requires ICD-10-CM for recording patient diagnoses and problems in certified EHR technology for billing and clinical documentation purposes.

Under HIPAA, a covered entity may share PHI with a public health authority without patient authorization for which purpose?

Answer: Disease surveillance and reporting

HIPAA's public health activities exception permits disclosure of PHI to public health authorities for disease surveillance, reporting, and prevention without patient authorization.

What is the primary purpose of a HIPAA Risk Analysis?

Answer: To identify potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI

A HIPAA Risk Analysis identifies and assesses potential threats and vulnerabilities to ePHI to determine appropriate safeguards, as required by the Security Rule.

Which of the following is a required implementation specification (not addressable) under the HIPAA Security Rule?

Answer: Unique user identification

Unique user identification is a required implementation specification under the HIPAA Security Rule's Access Control standard, meaning it must be implemented.