Regulatory Compliance & Quality - Section 3: HIPAA Flashcards
What are the 3 rules in HIPAA governing data privacy and security?
Privacy, security, and breach notification
True or False:
Clinics must have policies and procedures to address the privacy, security, and breach notification rules as well as documentation of implementation
True
Clinic must have policies and procedures to address the privacy, security, and breach notification HIPAA rules, as well as documentation of ___
Implementation
Which rule addresses all forms of protected health information - paper, electronic, and oral
Privacy Rule
Which rule stipulates that safeguards must be implemented to prevent uses and disclosures of a patient’s protected health information without the patient’s authorization or expressed authorization within the rule itself.
Privacy Rule
True or False:
The Privacy Rule stipulates that there are instances in which the patient’s permission to disclose protected health information is not required
True
The Security Rule applies only to ___ forms of PHI
Electronic
The primary goal of the Security Rule is to protect the privacy of individuals PHI while allowing covered entities to adopt new technologies for what purpose?
To improve the quality and efficiency of patient care
Given tat the health care marketplace is diverse, the Security Rule is designed to be ___ and ___ so a covered entity can implement policies, procedures, and technologies that are appropriate for the entity’s particular size, organizational structure, and risks to consumers’ E-PHI
Flexible and scalable
Breach notification objectives require covered entities and their business associates to report breaches in privacy or security due to ___ health information
Unprotected
There is a set of ___ individually identifiable health information that could be used to identify a patient
18
These are the safeguards that HIPAA expects to be in place
Standards
The steps needed to achieve the requirements of a given standard
Implementation specification
All standards are ___
Required
Some implementation specifications are ___, which means that you must implement those standards
Required
Addressable does not mean ___
Optional
Addressable means that you must perform an assessment to determine if the implementation specification is ___ and ___ for your organization
Appropriate and reasonable
Health plans, clearinghouses, and providers which electronically transmit or receive any PHI
Covered entity
What are 3 examples of a covered entity?
Health plans, clearinghouses, and providers
Any organization or process working in an association with or providing services to a covered entity who handles or discloses PHI or personal health records
Business associate
What are the 3 situations when patients should receive the Notice of Privacy Practices?
The first time they visit the clinic, with every revision, and upon request
Post the Notice of Privacy Practices in a ___ area of your clinic
Visible
If you have a website, should you post the Notice of Privacy Practices on the website?
Yes
True or False:
The Notice of Privacy Practice must contain the following statement: “This notice describes how medical information about you may be used and disclosed and how you can get access to this information, Please review it carefully.”
True
A description and at least ___ example of the types of uses and disclosures that your clinic uses PHI for: treatment, payment, and healthcare options
One
True or False:
Notice of Privacy Practices Uses and Disclosures should include a statement and example of uses and disclosures that do and do not require authorization
True
NPP Individual Rights
Request ___ on certain uses and disclosures of PHI, including a statement that your clinic does not have to agree to a requested restriction
Restrictions
True or False:
If a patient requests restrictions on certain uses and disclosures of PHI, your clinic must agree to it
False; your clinic does not have to agree to a requested restriction
NPP Individual Rights
Receive \_\_\_ communications Right to \_\_\_ and \_\_\_ PHI Right to request an \_\_\_ to PHI Right to receive an accounting of \_\_\_ Right to receive your NPP \_\_\_ and/or upon \_\_\_
Confidential Inspect and copy Amendment Disclosures Electronically and/or upon request
NPP Complaints
Information on how to file a privacy/security complaint with your clinic and with the ___ of ___
Secretary of HHS
NPP Contact
Contact information for the person in your clinic responsible for ___
Does not have to include their name, but must include a title such as “___ ___”
Privacy
Privacy Officer
NPP Effective date
The date the NPP became ___ and the date it was last ___
Effective
Revised
Who should access to PHI be limited to?
Those with a legitimate reason within their job duties to see PHI
Limit disclosures of PHI in your clinic to the amount reasonably necssary to achieve the purpose of ____ (i.e., referrals to other providers, disclosures to payers)
Disclosure
Develop a ___ (or policy) designed to limit the PHI within a given disclosure or access to PHI
Criteria
The business record generated at or for a healthcare organization
Legal record set
The record that would be released upon receipt of a request
Legal record set
