Chapter 12 Test 4

Question 1

Protection of information from loss, unauthorized access, or misuse, along with protecting its confidentiality

Answer 1

Security

Question 2

Protects PHI regardless of the medium on which it resides

Answer 2

Privacy rule

Question 3

Protects electronic PHI (ePHI)

Answer 3

Security rule

Question 4

Lack of alteration of destruction in an unauthorized manner

Answer 4

Integrity

Question 5

Not made available or disclosed to unauthorized persons or processes

Answer 5

Confidentiality

Question 6

HIPAA Security Rule Protects ePHI that is:

Answer 6

Created
Maintained
Transmitted
Received

Question 7

HIPAA Security rule Required compliance date

Answer 7

April 2005

Question 8

Small health plans date

Answer 8

April 2006

Question 9

Changes included as part of HITECH (a portion of ARRA)

Passed by Congress in _______

Answer 9

February 2009

Question 10

Enforcement of the Security Rule was assumed by the _________ in 2009 (taken over from Centers for Medicare and Medicaid Services)

Answer 10

Office for Civil Rights of HHS

Question 11

PHI maintained or transmitted in electronic form
For example, tapes, disks, optical disks, hard drives, servers, Internet, private networks
Not included: Voice mail messages, paper-to-paper faxes; copy machines

Answer 11

ePHI

Question 12

HIPAA Security Rule Must be implemented

Answer 12

Required (R)

Question 13

HIPAA Security Rule Must be implemented as the rule states or in an alternate manner or documented that risk does not exist or is negligible
Addressable implementation specifications cannot be ignored

Answer 13

Addressable (A)

Question 14

Covered entities and BAs must use a ________ to decide which security measures to implement.

Answer 14

Risk analysis

Question 15

__________ should be conducted to determine the cost of compliance.

Answer 15

Financial analysis

Question 16

Implement policies and procedures to prevent, detect, contain, and correct security violations

Answer 16

Security Management Process

Question 17

Identify a security official to develop and implement security policies and procedures to manage and supervise the use of security measures and the conduct of personnel in relation to protecting the data

Answer 17

Assigned Security Responsibility

Question 18

Implement policies and procedures to ensure appropriate access to ePHI

Answer 18

Workforce Security

Question 19

Implement policies and procedures authorizing access to ePHI

Answer 19

Information Access Management

Question 20

Implement a security and awareness training program for all workforce members

Answer 20

Security Awareness Training

Question 21

Implement policies & procedures to address security incidents

Answer 21

Security Incident Procedures

Question 22

Establish policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems containing ePHI

Answer 22

Contingency Plan

Question 23

Perform a periodic technical and non-technical evaluation, based initially upon the standards implemented under this rule and subsequently, in response to environmental or operational changes affecting the security of ePHI, that establishes extent to which an entity’s security policies and procedures meet HIPAA requirements

Answer 23

Evaluation

Question 24

A covered entity may permit a BA to create, receive, maintain, or transmit ePHI on the covered entity’s behalf only if the covered entity obtains satisfactory assurances the BA will appropriately safeguard the information

Answer 24

Business Associate Contracts & Other Arrangements

Question 25

Implement policies and procedures to limit physical access to electronic information systems and the facility(ies) in which they are housed, while ensuring that properly authorized access is allowed

Answer 25

Facility Access Controls

Question 26

Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can access ePHI

Answer 26

Workstation Use

Question 27

Implement physical safeguards for all workstations that access ePHI, to restrict access to authorized users

Answer 27

Workstation Security

Question 28

Implement policies and procedures that govern the receipt/removal of hardware and electronic media containing ePHI into and out of a facility, and the movement of these items within the facility

Answer 28

Device and Media Controls

Question 29

Implement technical policies and procedures for electronic information systems that maintain ePHI to allow access only to those persons or software programs that have been granted access rights

Answer 29

Access Controls

Question 30

Implement hardware, software, or procedural mechanisms that record and examine activity in information systems that contain or use ePHI

Answer 30

Audit Controls

Question 31

Implement policies and procedures to protect ePHI from improper alteration/destruction

Answer 31

Integrity

Question 32

Implement procedures to ensure the validity of a person or vendor seeking access is the one claimed

Answer 32

Person or Entity Authentication

Question 33

Implement technical security measures to guard against unauthorized access to ePHI transmitted over an electronic communications network

Answer 33

Transmission Security

Question 34

Requires plan sponsor to reasonably and appropriately safeguard the confidentiality, integrity, and availability of ePHI

Answer 34

Group health plans

Question 35

Implement ___________ to comply with the standards, implementation specifications, and other requirements
____________ may be changed at any time, as long as the changes are documented and implemented

Answer 35

Policies and Procedures

Question 36

Requires maintenance of policies and procedures implemented to comply with the security rule in written form

Answer 36

Documentation

Question 37

Unknowing violations fine amount

Answer 37

$100–$50,000/violation

Question 38

Due to reasonable cause (and not willful neglect) fine amount

Answer 38

$1,000–$50,000/violation

Question 39

Due to willful neglect and corrected within 30 days of discovery fine amount

Answer 39

$10,000–$50,000/violation

Question 40

Due to willful neglect and not corrected as required fine amount

Answer 40

$50,000+/violation

Question 41

Cap of ______ for each violation category

Answer 41

$1.5 million