Healthcare Analytics Policy & Compliance Flashcards

Under HIPAA's Minimum Necessary Standard, a healthcare analyst requesting a full patient dataset for a quality improvement project should:

Answer: Request only the data elements needed to accomplish the specific analytical purpose

The Minimum Necessary Standard requires that access to PHI be limited to only the information needed to accomplish the intended purpose.

Which federal law governs the privacy and security of substance use disorder patient records, often requiring stricter protections than HIPAA?

Answer: 42 CFR Part 2

42 CFR Part 2 provides special confidentiality protections for records of patients treated for substance use disorders, requiring explicit patient consent for most disclosures.

A healthcare organization experiences a breach affecting 600 patients' PHI. Under HIPAA Breach Notification Rule, the covered entity must notify HHS:

Answer: Within 60 days of the end of the calendar year in which the breach was discovered

For breaches affecting fewer than 500 individuals, HIPAA allows covered entities to log and report to HHS annually, within 60 days after the calendar year ends.

The HITECH Act enhanced HIPAA enforcement by:

Answer: Increasing civil monetary penalties and extending HIPAA obligations to business associates

HITECH strengthened HIPAA by raising penalties (up to $1.9M per violation category per year) and making business associates directly liable for HIPAA compliance.

A data analytics team wants to use patient data for research without individual patient authorization. Which HIPAA pathway allows this if an IRB waives authorization requirements?

Answer: Research exception under 45 CFR §164.512(i)

HIPAA permits use of PHI for research without authorization when an IRB or Privacy Board waives the authorization requirement under 45 CFR §164.512(i).

Under the CMS Promoting Interoperability Program, eligible hospitals that fail to demonstrate meaningful use of certified EHR technology face:

Answer: A payment adjustment (reduction) to their Medicare reimbursements

Hospitals that do not meet Promoting Interoperability requirements face a downward payment adjustment applied to their Medicare inpatient prospective payment system rates.

Which standard framework specifically addresses electronic health information exchange security controls and is frequently referenced alongside HIPAA compliance programs?

Answer: NIST Cybersecurity Framework (CSF)

The NIST Cybersecurity Framework is widely adopted by healthcare organizations to supplement HIPAA Security Rule requirements and manage cybersecurity risk systematically.