HIPAA Lesson 11 Flashcards
The ______ program serves as a new part of OCR’s health information privacy and security compliance program. OCR will use the _______ program to assess HIPAA compliance efforts by a range of covered entities. _______ present a new opportunity to examine mechanisms for compliance, identify best practices, and discover risks and vulnerabilities that may not have come to light through OCR’s ongoing complaint investigations and compliance reviews.
OCR will broadly share best practices gleaned through the ______ process and guidance targeted to observed compliance challenges via this website and other outreach portals.
Audit(s)
Lawmakers didn’t want hospitals, doctors’ offices, and other covered entities to start using new technologies just for the sake of using them. Instead, they want CEs to use the technologies ______.
Meaningfully
Meaningful use first appeared in the ______ legislation that required all healthcare providers to use an electronic health record (EHR).
ARRA/HITECH
CMS began a program to provide financial incentives for the meaningful use of EHR technology to accomplish these five tasks. List the tasks.
- Improve quality, safety, and efficiency
- Engage patients and families in their healthcare
- Improve care coordination
- Improve public health
- Maintain privacy and security
The meaningful use incentive programs require proof (called an _____) that covered entities have met certain meaningful use core requirements within specified timeframes.
Attestation
Meaningful Use - Maintain Privacy & Security core elements:
- Provide patients with an electronic copy of their health information upon request.
- Protect electronic health information.
The ACA established two identifiers: ______ & _____. It also set some new requirements for HIPAA transactions called _____ rules, and it required _______ of electronic funds transfers (EFT).
- HPID
- OEID
- Operating
- Standardization
Compliance date for implementation of the ICD-10-CM and ICD-10-PCS code sets.
October 1, 2015
Certification, Part 1—Health plan must certify data and information systems are in compliance with applicable standards and operating rules for:
• Eligibility for a health plan
• Health claim status
• Health care electronic funds transfers and remittance advice
December 31, 2013
Effective date of operating rules for health care electronic funds transfers and remittance advice
January 1, 2014
Effective date of standards for electronic funds transfers
January 1, 2014
Controlling health plans must obtain health plan identifier.
November 5, 2014
Small health plans must obtain health plan identifier.
November 5, 2015
Certification, Part 2—Health plans must certify that their data and information systems comply with applicable standards and operating rules for:
• Health claims or equivalent encounter information
• Enrollment and disenrollment in a health plan
• Health plan premium payments
• Referral certification and authorization
• Health claims attachments
December 31, 2015
Effective date of operating rules for:
• Health claims or equivalent encounter information
• Enrollment and disenrollment in a health plan
• Health plan premium payments
• Referral certification and authorization
Effective date of standard and operating rules for health claims attachments
January 1, 2016
Covered entities must use HPID to identify health plans in transactions.
November 7, 2016
A _____ is, generally, an impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information.
Breach
An impermissible use or disclosure of protected health information is presumed to be a _____ unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the protected health information has been compromised based on a _____.
- Breach
- Risk Assessment
3.
List the four Risk Assessment factors:
- The nature and extent of the protected health information involved, including the types of identifiers and the likelihood of reidentification;
- The unauthorized person who used the protected health information or to whom the disclosure was made;
- Whether the protected health information was actually acquired or viewed; and
- The extent to which the risk to the protected health information has been mitigated.
Is this incident a breach?
The accessed information was deidentified (stripped of identifying information), or it’s unlikely that the patient or patients can be reidentified.
No
Is this incident a breach?
The person who obtained the information wasn’t a threat (in other words, nobody used the information wrongfully).
No
Is this incident a breach?
Someone acquired or viewed the information.
Yes
Is this incident a breach?
Someone discovered and did not correct the disclosure.
Yes
