HIPAA HITECH Act and Technology Requirements

Question 1

What does the HITECH Act stand for and when was it enacted?

Accepted Answer

Health Information Technology for Economic and Clinical Health, 2009

Answer

Health Information Technology for Enhanced Clinical Health, 2011

Answer

Healthcare Information Technology Enforcement and Compliance Health, 2010

Answer

Health Information Technical Exchange and Clinical Health, 2008

Question 2

How did the HITECH Act change HIPAA's enforcement penalties for covered entities?

Accepted Answer

HITECH created a tiered penalty structure based on culpability with maximum penalties up to $1.9 million per violation category per year

Answer

HITECH reduced penalties to encourage voluntary compliance

Answer

HITECH made all HIPAA violations criminal offenses

Answer

HITECH replaced civil penalties with mandatory corrective action plans only

Question 3

Under the HITECH Act, who became directly subject to HIPAA's Security Rule obligations for the first time?

Accepted Answer

Business associates, including EHR vendors and IT contractors handling PHI

Answer

State health departments

Answer

Individual physicians in private practice

Answer

Health insurance exchanges

Question 4

What is the 'Breach Notification Rule' that HITECH established for unsecured PHI?

Accepted Answer

A mandate requiring notification to affected individuals, HHS, and potentially media when unsecured PHI is breached

Answer

A requirement to report all security incidents to law enforcement within 24 hours

Answer

A rule allowing covered entities to self-insure against breach costs

Answer

Voluntary reporting guidance for organizations discovering potential HIPAA violations

Question 5

What technology 'safe harbor' did HITECH create for breached PHI?

Accepted Answer

Encrypting PHI using NIST-approved methods, which renders a breach presumptively non-reportable

Answer

Using any password protection on electronic files containing PHI

Answer

Storing all PHI on US-based servers

Answer

Using two-factor authentication for all PHI access

Question 6

Under HITECH, what is the maximum daily penalty cap for violations of the same type in a single calendar year?

Accepted Answer

$1,900,000

Answer

$100,000

Answer

$500,000

Answer

$1,000,000

Question 7

What did HITECH require regarding state attorneys general and HIPAA enforcement?

Accepted Answer

HITECH authorized state attorneys general to bring civil actions for HIPAA violations affecting state residents

Answer

HITECH removed state authority over health information privacy

Answer

States were prohibited from enacting stricter privacy laws after HITECH

Answer

Only the federal government retained enforcement authority under HITECH

Question 8

How did HITECH change the HIPAA requirement for accounting of disclosures when EHRs are used?

Accepted Answer

HITECH required covered entities using EHRs to account for treatment, payment, and operations disclosures upon request

Answer

HITECH eliminated the accounting of disclosures requirement

Answer

HITECH limited accounting to only third-party disclosures outside the covered entity

Answer

No changes to accounting of disclosures were made by HITECH

Question 9

What was the purpose of HITECH's 'Meaningful Use' program as it relates to health technology?

Accepted Answer

To create financial incentives for providers adopting certified EHR technology and demonstrating its effective use

Answer

To mandate specific EHR software vendors for all healthcare providers

Answer

To eliminate paper records within 5 years

Answer

To subsidize cybersecurity programs for small practices only

Question 10

Under HITECH, what minimum security standard applies to PHI transmitted via email?

Accepted Answer

PHI in email must be encrypted using NIST-approved encryption to receive the breach notification safe harbor

Answer

Standard email without additional security is acceptable for PHI transmission

Answer

Email can never be used for PHI regardless of encryption

Answer

Only encrypted email to other covered entities is permitted