EO 001.03 - CFHIS Flashcards
Describe CFHS compliance with federal privacy legislation and policies
Describe CFHS confidentiality rules
Describe compliance with federal and DND physical and electronic security policies
Describe rules for CFHIS access
What is the purpose of audit logs
The purpose of audit logs is for system administration, maintenance, security, and to ensure compliance with Treasury Board Secretariat, DND/CAF orders, policies, instructions, directives and standards
Describe investigation processes and infraction penalties
Infraction penalties can include temporary suspension, revocation, or permanent termination
Define Security techniques
Security techniques refers to the procedures and tools we use to protect information entrusted to us
What are the three types of security levels?
- Public (Unclassified)
- Classified (Confidential, Secret, or Top Secret)
- Designated (PROTECTED A, B, C)
Define the Need-To-Know principle
Only persons who have a requirement to perform their official duties shall access PHI
Define Disclosure
The release or transfer of personal information by any to any body or person
What are three rules that must comply with “PROTECTED B” information?
- Clearly label (on every header, footer, and envelope side)
- Destroy in approved shredders/burn bags
- Encrypt when electronically stored or sent
Define Personal Information
Information about an identifiable individual
(i.e. race, national/ethnic origin, religion, educational/medical history, identifying numbers/symbols)
Define Personal Health Information (PHI)
Personal information that relates to an individual’s diagnostic, treatment, or care information
(i.e. medical/dental/psychosocial information collected during care
What type of information is NOT applicable to PHI?
- A CAF member’s medical employment limitations
- Anticipated absences from the workplace
- Prognosis
- General severity of an acute health condition
True or false, all CAF health records are property of the crown
True
List acceptable reasons to disclose PHI
- Patient authorized disclosure
- Printing/copying a CAF health record where required in the performance of official duties
- Release outlined on a court order, warrant, writ, summons, or other process issued by a court
- MELs, anticipated absences, prognosis/severity of a health condition to the CoC of the member
CAF members are;
a) Have the right to access of their own information
b) Are only entitled to request access to their information
Correct answer: B
Members are only entitled to request access to their own information
Access to CFHIS will require what?
- DWAN account
- CFHIS account
- Public key infrastructure card
- CFHIS equipped treatment bay (computer)
All suspected breaches MUST be reported to:
- Your manager/supervisor
- CH H Svcs Gp Privacy Office
- Local ISSO
- CFHIS Local and/or National ISSO
What are the nine responsibilities of the CFHIS user?
- Only use PHI to perform official duties
- Use and disclose PHI if needed by adhering to the Privacy Act
- Disclose the nature of any conflict of duties to CO, immediate supervisor
- Only request access to your own PHI as per DAOSs 1002-1 & 1002-2
- Only use your own CFHIS user account and PKI card when electronically accessing PHI
- Ensure terminals or workstations in use are logged off or unlocked when unattended or not in use
- Inform the helpdesk and CFHIS local ISSO if your CFHIS user account is no longer required
- Promptly report all known or suspected losses or compromises of PHI to your CO, immediate supervisor or ISSO
- Read, understand and observe the directives, orders, instructions and policies in the CFHIS e-learning modules
Audit logs record every transaction users make in CFHIS, true or false?
True, every transaction is recorded including the following information:
- User name
- Folder opened
- Document/record which was viewed/modified/printed
- Patient name or record assessed
- Date and time of access
What does CFHIS stand for?
Canadian Forces Health Information System
What does DAIP stand for?
Directorate of Access to Information and Privacy
What does DAOD stand for?
Defense Administrative Orders and Directives
What does DHSD stand for?
Director Health Services Delivery
What does EHR stand for?
Electronic Health Record
What does ISSO stand for?
Information System Security Officer
What does PHI stand for?
Personal Health Information
What does PKI stand for?
Public Key Infrastructure
True or false, patients may request to see who has accessed their CFHIS records?
True.
The Audit log will be supplied to the Local ISSO and the patient will be provided with verbal guidance from the CFHIS Local ISSO or the CFHIS National ISSO on how to read the log.
What is CFHIS used for?
- Booking and management of patient appointments
- Recording and reviewing patient history (i.e. attached documents, imaging reports, lab results, etc)
- Management of the recall list and waiting list
