Healthcare Analytics Policy & Compliance Flashcards
7 cards from real HAC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Healthcare Analytics Policy & Compliance flashcards as text
A healthcare organization uses a cloud-based analytics platform. Under HIPAA, the cloud service provider (CSP) storing ePHI is considered a business associate even if:
Answer: All of the above scenarios still require a Business Associate Agreement
HHS confirmed that CSPs storing ePHI are business associates regardless of encryption key access, geographic location, or infrastructure-only roles, and must sign a BAA.
The Medicare Access and CHIP Reauthorization Act (MACRA) established the Quality Payment Program (QPP). From a data analytics compliance perspective, clinicians must:
Answer: Report performance data meeting CMS specifications or face payment adjustments
Under QPP/MIPS, eligible clinicians must submit quality, improvement activities, and promoting interoperability data to CMS or face negative payment adjustments (or earn bonuses).
A hospital's analytics team is building a model to predict 30-day readmissions. To comply with CMS Hospital Readmissions Reduction Program (HRRP) policy, the model should account for:
Answer: Socioeconomic and social risk factors, since CMS stratifies readmission rates by patient social risk
CMS now stratifies HRRP performance by dual eligibility status to account for social risk, and analytics models should incorporate these factors for accurate program impact assessment.
Under the HIPAA Privacy Rule, a covered entity may use PHI for 'healthcare operations' without patient authorization. Which activity qualifies as a healthcare operations use?
Answer: Conducting quality assessment and improvement activities including data analytics for performance review
Quality assessment, improvement activities, and case management are explicitly defined as healthcare operations under 45 CFR §164.501, permitting PHI use without individual authorization.
The General Data Protection Regulation (GDPR) becomes relevant to a US-based healthcare analytics company when:
Answer: The company processes health data of EU residents, regardless of where the processing occurs
GDPR applies based on the location of the data subject, not the company; processing health data of EU residents subjects US companies to GDPR obligations regardless of where processing occurs.
A Covered Entity's Notice of Privacy Practices (NPP) must be updated and redistributed when:
Answer: There is a material change to the organization's privacy policies or practices
Covered entities must promptly revise and distribute a new NPP whenever there is a material change to their privacy practices that affects patient rights or the organization's obligations.
Under CMS's Conditions for Coverage, a hospital that shares identifiable patient outcome data with an external analytics firm for population health benchmarking must ensure:
Answer: A valid Business Associate Agreement is in place and the data sharing is within the scope of permitted healthcare operations
Sharing PHI with an external analytics firm for benchmarking requires a BAA and must fall within a permissible use category such as healthcare operations under HIPAA.