HIPAA Lesson 10 Flashcards
The Privacy Rule requires covered entities to put in place physical safeguards to protect the confidentiality of all PHI. Here are some examples:
- Locks on filing cabinets to protect paper PHI
- Privacy screens on computer monitors to protect electronic PHI
- Privacy curtains to protect visual PHI (for instance, in the emergency room)
- Paper shredders to protect paper PHI
- Quiet conversations to protect oral PHI
- Access control to areas with any kind of PHI
There are three main issues to consider relating to physical safeguards:
- How environmental issues affect systems
- How individuals enter an environment that may include sensitive systems or sensitive data
- Which types of physical security solutions are effective in identifying individuals and the extent of their access to facility areas
Physical security is one area where the __________ need to work together to find solutions.
Privacy and Security Officer
When the privacy and security officer put their heads together, they need to ask these questions:
- Is access to the building controlled?
- Is access to the computing facility controlled?
- Does the organization require additional controls for access after hours?
- Is there an audit log that records the individuals who enter the building, including the location of access and the time of access?
- Has the team adequately protected systems from theft?
- Are adequate procedures in place for disposal of protected health information in accordance with HIPAA requirements?
- Do team members make sure to secure their workstations during and after hours?
- Is someone monitoring and controlling the activities of cleaning crews?
- Has the organization developed and tested a plan for operating in the event of an emergency?
- Do team members send data backups to an off-site location for safe storage?
- Has the organization developed procedures for testing and revising applications and systems?
- Have members of the workforce received training on key security issues?
- Has a disaster recovery plan been developed and tested to accommodate the possibility of damage to all or part of the facility?
- Are procedures in place to retrieve facility access devices (keys, swipe cards, and so on) when members of the workforce are terminated or no longer need access to the facility?
- What’s the procedure when a member of the workforce no longer requires access to the facility? Are access-management processes in place to change locks, change external combinations, deactivate access cards, and so on?
- What steps are in place to protect against exposure if someone (such as a terminated employee or a vendor) inappropriately gains access to a facility? Has the team established access management for keys, security tokens, or fobs?
- Has the team established safeguards to protect PHI from inadvertent exposure to the public?
List the four standards of Physical Safeguards:
- Facility Access Controls
- Workstation Use
- Workstation Security
- Device & Media Controls
List the four implementation specifications for Facility Access Controls:
- Contingency operations (A)
- Facility security plan (A)
- Access control and validation procedures (A)
- Maintenance records (A)
What are the implementation specifications for the Workstation Use and Workstation Security standards?
None
List the implementation specifications for Device and Media Controls:
- Disposal (R)
- Media reuse (R)
- Accountability (A)
- Data backup and storage (A)
Implement policies and procedures to limit physical access to electronic information systems and areas where sensitive paper documents are stored and any facilities in which they are housed, while ensuring authorized access.
Facility Access Controls
Covered entities must make plans to include access to the covered entity’s own facility or to an alternate facility in the case of an emergency.
Contingency Operations (A)
This implementation specification requires covered entities to address policies and procedures to safeguard facilities and equipment. The plan should prevent unauthorized physical access, tampering, PHI viewing, and theft.
Facility Security Plan (A)
Covered entities should address implementing policies and procedures to control access to facilities. You should base access on a person’s role or function. And your policies should include visitor control and access to software programs for testing and revision.
Access Controls and Validation Procedures (A)
Covered entities should address implementing policies and procedures to fully document repairs and modifications to the physical components of a facility that relate to security. Think in terms of hardware: walls, doors, locks, external keypads to doors, and alarms.
Maintenance Records (A)
A ________ is an electronic computing device.
Workstation
Implement policies and procedures that specify the proper functions to be performed, the manner in which those functions are to be performed, and the physical attributes of the surroundings of a specific workstation or class of workstation that can be used to access EPHI.
Workstation Use
The workstation use standard also requires that workstation locations be secure, such as:
- Physical attributes of the surroundings
- Sensitivity of data that’s accessible from a site
- Monitor positioning (screens turned away to prevent public viewing)
Implement physical safeguards for all workstations that can be used to access EPHI, to restrict access to authorized users.
Workstation Security
Workstation security is about preventing _______ of workstations.
Theft
Implement policies and procedures that govern the receipt and removal of hardware and electronic media and devices that contain EPHI into and out of a worksite or facility, and the movement of these items within the worksite or facility.
Device and Media Controls
It requires covered entities to have policies and procedures to address the final disposition of electronic protected health information and the hardware or electronic media on which it’s stored. This specification covers archiving and retention of EPHI and the ultimate destruction of EPHI.
Disposal
