HIPAA Electronic Health Records (EHR) Compliance 5

Question 1

A physician group uses an EHR system with a shared login for all nurses. Which HIPAA requirement does this violate?

Accepted Answer

Unique user identification

Answer

HIPAA's Security Rule requires that each user of an EHR system have a unique identifier to enable individual accountability and accurate audit trails.

Question 2

A patient's EHR is subpoenaed in a malpractice case. Under HIPAA, what must the covered entity do before releasing records?

Accepted Answer

Obtain a qualified protective order or patient authorization before release

Answer

HIPAA requires a qualified protective order or patient authorization before releasing ePHI in response to a subpoena that is not accompanied by a court order.

Question 3

Which of the following scenarios represents a HIPAA-compliant use of de-identified EHR data?

Accepted Answer

Providing data with all 18 HIPAA identifiers removed to a pharmaceutical company for research

Answer

De-identification under HIPAA's Safe Harbor method requires removing all 18 specified identifiers, after which the data is no longer considered PHI.

Question 4

An EHR system experiences a ransomware attack that encrypts all patient records. Under HIPAA, is this automatically a reportable breach?

Accepted Answer

Yes, unless the covered entity can demonstrate low probability of ePHI compromise

Answer

OCR guidance states that ransomware attacks are presumed breaches unless the covered entity demonstrates through a risk assessment that ePHI was not compromised.

Question 5

Under HIPAA, what is required when a covered entity terminates a workforce member who had EHR access?

Accepted Answer

Revoke the employee's EHR access as part of a termination procedure

Answer

HIPAA's Security Rule requires covered entities to have workforce clearance procedures that include revoking EHR access promptly upon termination.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Electronic Health Records (EHR) Compliance 5