HIPAA Privacy & Security Rules Flashcards

A medical transcriptionist's supervisor asks them to transcribe a family member's dictated record as a favor. What is the correct response?

Answer: Decline, as accessing the family member's PHI without a legitimate work purpose violates HIPAA

Accessing PHI without a legitimate work need violates the HIPAA Minimum Necessary Standard and can constitute snooping, regardless of supervisory approval.

What is the purpose of a HIPAA Risk Analysis?

Answer: To identify and assess potential vulnerabilities and threats to ePHI confidentiality, integrity, and availability

A Risk Analysis is a required Administrative Safeguard that identifies potential threats and vulnerabilities to ePHI so the organization can implement appropriate security measures.

Which of the following identifiers, if present in health data, prevents it from being considered de-identified under HIPAA Safe Harbor?

Answer: The patient's three-digit ZIP code prefix if the area has more than 20,000 people

Under HIPAA Safe Harbor, the first three digits of ZIP code must be suppressed if the geographic unit contains fewer than 20,000 people; ZIP prefixes with more than 20,000 people may be retained.

A patient requests an amendment to their medical record, claiming the physician's note contains an error. Under HIPAA, which scenario allows the covered entity to DENY the amendment request?

Answer: The record was not created by the covered entity receiving the amendment request

A covered entity may deny an amendment request if the PHI was not created by that entity, among other valid grounds listed in the Privacy Rule.

What is the role of a HIPAA Privacy Officer?

Answer: To develop, implement, and maintain the organization's HIPAA privacy policies and procedures

The Privacy Officer is responsible for developing, implementing, and overseeing the organization's HIPAA privacy compliance program, including policies and training.

Under the HIPAA Security Rule, which type of control is 'audit controls'?

Answer: Technical Safeguard

Audit controls are a Technical Safeguard requirement under the HIPAA Security Rule, requiring hardware/software/procedures to record and examine ePHI access activity.

A medical transcriptionist finishes a shift and leaves their workstation without logging off, allowing the next user to see open PHI files. Which HIPAA Security Rule standard is violated?

Answer: Technical Safeguards — Automatic Logoff

The HIPAA Security Rule's Technical Safeguards include an Automatic Logoff implementation specification to terminate sessions after inactivity to prevent unauthorized PHI access.