HIPAA HITECH Act and Technology Requirements 5

Question 1

Under HITECH, when a covered entity discovers a breach affecting 500 or more individuals in a state, when must media notification occur?

Accepted Answer

Within 60 days of discovery

Answer

Covered entities must notify prominent media outlets in affected states within 60 days of discovering a breach that affects 500 or more state residents.

Question 2

Which standard specifies the encryption requirements for PHI at rest that satisfy HITECH's breach notification safe harbor?

Accepted Answer

FIPS 140-2

Answer

NIST guidance specifying FIPS 140-2 validated encryption processes is referenced as the standard for PHI at rest to qualify for HITECH's safe harbor.

Question 3

How did HITECH change the HIPAA requirement for covered entities to obtain patient authorization for psychotherapy notes used in treatment?

Accepted Answer

HITECH did not change psychotherapy note authorization requirements

Answer

HITECH did not change HIPAA's existing requirement that psychotherapy notes require authorization even for treatment purposes—that protection predates HITECH.

Question 4

Under HITECH, what must a covered entity do if an individual requests a restriction on disclosure of their PHI to a health plan for a service the individual paid for out-of-pocket?

Accepted Answer

The covered entity must agree to the restriction

Answer

HITECH requires covered entities to honor a patient's request to restrict disclosure to a health plan when the patient has paid out-of-pocket in full for the service.

Question 5

A cloud service provider stores encrypted PHI for a covered entity but cannot access the encryption keys. Under HITECH, is this provider a business associate?

Accepted Answer

Yes, because they create, receive, maintain, or transmit PHI on behalf of the covered entity

Answer

HHS has clarified that a cloud service provider handling encrypted PHI is a business associate even without access to decryption keys, because they maintain PHI on behalf of a covered entity.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA HITECH Act and Technology Requirements 5