Privacy

Question 1

§164.530(c)(2)(i) PRIVACY Personnel:

How is access to PII, PHI or ePHI safeguarded from unauthorized access in your area.

Answer 1

1) Keys
2) Card swipes
3) Other
4) Permissions

Question 2

§164.530(c)(2)(i) PRIVACY Personnel:

How is your staff trained on privacy and security?

Answer 2

1) Are there any checklists for in-department on-boarding.

2) Are there any policies or procedures documented.

Question 3

Terminations:

Please describe your termination process for both voluntary (resignation) or involuntary termination’s.

Answer 3

1) Are there any special processes such as the requirement to take office keys or building keys.

Question 4

Terminations:

How are people terminated from your ________ department/special applications.

Answer 4

Please describe the process.

1) Who notifies IT?

Question 5

Collection of Fees / PCI. DSS:

Are you required to collect any fees for services such as: medical records fees, parking fees, etc.

Answer 5

Please describe the process.

Question 6

Collection of Fees / PCI DSS:

What form of payment do you accept?

Answer 6

How are the credit cards processed?

How are checks processed?

How is cash processed?

Question 7

Collection of Fees / PCI DSS:

If they use a card swipe terminal is that device connected to the network, phone line or is it a stand-alone (cell service) device.

Answer 7

When was the last PCI audit performed on the terminal.

Question 8

General:

Is information ever taken via the phone and or written down?

Answer 8

What happens to that paperwork once you’re completed with it?

Question 9

§164.530(c)(2)(i) PRIVACY Personnel:

Please describe your staff, their roles and responsibilities as well as any third parties you may work with.

Answer 9

(a) Inquire of management as to whether administrative, technical,
and physical safeguards are in place to protect all PHI.

(b) Obtain and review procedures and policies and evaluate the
content to determine if administrative, technical, and physical
safeguards are in place to protect all PHI (e.g., electronic PHI,
written PHI, rules about speaking about PHI).

(d) Observe and verify whether the safeguards in place are
appropriate.

Question 9

General:

Is information ever taken via the phone and or written down?

Answer 9

What happens to that paperwork once you’re completed with it?

Question 11

General:

Do you utilize a departmental drive?

Answer 11

What information is stored on your departmental drive?

How would someone gain access to that share?

Question 12

Contingency planning:

Do you have a documented emergency disaster recovery plan.

Answer 12

Where is the plan kept.

How was the plan updated.

When was the last time the plan was updated.

How is the plan tested.

When was the last time you tested the plan.

Question 13

Medical records:

Where is the legal medical record kept? system / paper / other locations?

Answer 13

Please describe the process for a record that has been placed on the legal hold.

Question 14

Medical records:

Are any medical records left out during the night?

Answer 14

Please describe the process for safeguarding the medical record.

Question 15

Medical records:

Do you send ePHI to other facilities?

Answer 15

How do you send the ePHI?

Question 16

Medical records:

How are medical records check in and out of the department?

Answer 16

Please explain the process.

Question 17

Medical records:

Do you have a checklist for QA of the record that staff utilizes?

Answer 17

Please explain the QA process.

Question 18

Medical records:

How long do you keep medical records for, both computerized and a paper records.

Answer 18

Please explain the archival process.

Question 19

Medical records:

Please describe the process for access to medical record by third parties.

Answer 19

Are any records sent electronically?

Are any records sent via UPS? How?

Do you send any records to a PO Box?

Question 20

Medical records:

How are consents verified?

Answer 20

Do you have a documented process?

Question 21

Medical records:

If a fax is misdirected what process do you follow?

Is it documented?

Do you have a formal policy?

Answer 21

Please describe the process.

Do you complete a risk form and forward it to risk management?

Question 22

Training:

How do you provide in-service and/or security reminders to your staff?

Answer 22

Please describe your process.

• Weekly/monthly etc staff meetings.
• Email correspondence.

Question 23

Food Service:

Please describe the process for intake of a patient.

Answer 23

What software do they use?

How is access controlled to that software.

Question 24

Food Service:

How are the meal tickets produced?

What information is printed on the meal ticket?

Answer 24

We’re looking for any PHI or double identifier that may be printed on the meal ticket.

Question 25

Physical Security:

Are you in an open area or in a private office?

What’s the area your staff sits in?

Answer 25

Please describe all areas within your department.

Question 26

Physical Security:

It’s in a private office, do you lock your office when you’re not inside (this includes trips to the restroom).

Answer 26

Describe how the area is secured.

Question 27

Physical Security:

Do you use any third-party’s within the area such as night cleaning crew etc.?

Answer 27

Describe how is your area police/tidied up at end of day.

Question 28

Application usage:

What applications does your department utilize?

Answer 28

How is access granted to those applications?

Do they all go through a central location or are some created locally?

How was the applications installed if it’s not on the system?

Question 29

Food Service:

How are the meal tickets reconciled once the meal has concluded?

Answer 29

Are all the meal tickets returned?

How are they destroyed?

What if a meal ticket is not returned?

Question 30

Physical Security:

Are you in an open area or in a private office?

What’s the area your staff sits in?

Answer 30

Please describe all areas within your department.

Question 31

Physical Security:

It’s in a private office, do you lock your office when you’re not inside (this includes trips to the restroom).

Answer 31

Describe how the area is secured.

Question 32

Physical Security:

Do you use any third-party’s within the area such as night cleaning crew etc.?

Answer 32

Describe how is your area police/tidied up at end of day.

Question 33

Application usage:

What applications does your department utilize?

Answer 33

How is access granted to those applications?

Do they all go through a central location or are some created locally?

How was the applications installed if it’s not on the system?

Question 34

Physical Security:

Are there any cameras within your area?

Answer 34

How are those cameras how do those cameras work doesn’t work 24 x 7 recording if there’s a miss you how can you tell.

Question 35

Physical Security:

Are there any cameras within your area?

Answer 35

How are those cameras how do those cameras work doesn’t work 24 x 7 recording if there’s a miss you how can you tell.