HIPAA Privacy & Security Rules Flashcards

Which HIPAA Security Rule safeguard category includes policies for workstation use and device and media controls?

Answer: Physical Safeguards

Physical Safeguards under the HIPAA Security Rule include workstation use policies, workstation security, and device and media controls.

What does the HIPAA 'Right of Access' give patients the ability to do?

Answer: Inspect and obtain a copy of their own protected health information

The HIPAA Right of Access allows individuals to inspect and receive a copy of their PHI held by covered entities, generally within 30 days of the request.

Which of the following is an example of an Administrative Safeguard under the HIPAA Security Rule?

Answer: Conducting a workforce security awareness training program

Security awareness and training programs are explicitly listed Administrative Safeguards required by the HIPAA Security Rule.

Under HIPAA, which disclosure of PHI is permitted WITHOUT patient authorization?

Answer: Reporting a gunshot wound to law enforcement as required by state law

HIPAA permits disclosures required by law, such as mandatory reporting of gunshot wounds to law enforcement, without patient authorization.

A transcription company stores encrypted ePHI on a laptop that is stolen. Under HIPAA's Safe Harbor provision, how is this incident classified?

Answer: Not a breach, because the PHI is rendered unreadable through valid encryption

Under the Breach Notification Safe Harbor, loss or theft of properly encrypted ePHI does not constitute a reportable breach because the data is unreadable.

Which entity enforces HIPAA compliance and investigates complaints?

Answer: The Office for Civil Rights (OCR) within the U.S. Department of Health and Human Services

The Office for Civil Rights (OCR) within HHS is the primary federal agency responsible for enforcing HIPAA Privacy and Security Rules.

In HIPAA terminology, what is a 'covered entity'?

Answer: Health plans, healthcare clearinghouses, and healthcare providers who transmit PHI electronically

Covered entities under HIPAA are health plans, healthcare clearinghouses, and healthcare providers who transmit PHI in electronic form in connection with a HIPAA-covered transaction.