RHIA Domain 2 Flashcards
You are reviewing your privacy and security policies, procedures, training program, and so on, and comparing them to the HIPAA and ARRA regulations. You are conducting a
- policy assessment
- risk assessment
- compliance audit.
- risk management
risk assessment
Which of the following can be released without consent or authorization?
- summary of patient care
- de-identified health information
- personal health information
- protected health information
de-identified health information
Kyle, the HIM Director, has received a request to amend a patient’s medical record. The appropriate action for him to take is
- make the modification because you have received the request.
- file the request in the chart to document the disagreement with the information contained in the medical record
- route the request to the physician who wrote the note in question to determine the appropriateness of the amendment.
- return the notice to the patient because amendments are not allowed.
route the request to the physician who wrote the note in question to determine the appropriateness of the amendment.
An employee in the admission department took the patient’s name, social security number, and other information and used it to get a charge card in the patient’s name. This is an example of
- identity theft
- mitigation
- disclosure
- release of information
identity theft
Patient has submitted an authorization to release information to a physician office for continued care. The release of information clerk wants to limit the information provided because of the minimum necessary rule. What should the supervisor tell the clerk?
- Good call
- The patient is an exception to the minimum necessary rule, so proves the request as written
- The minimum necessary rule was eliminated with ARRA
- The minimum necessary rule only applies to attorneys.
The patient is an exception to the minimum necessary rule, so proves the request as written
Patricia is processing a request for medical records. The record contains an operative note and a discharge summary from another hospital. The records are going to another physician for patient care. What should Patricia do?
- Notify the requestor that redisclosure is illegal and so he must get the operative and discharge summary records from the original source hospital.
- Include the documents from the other hospital
- Redisclose when necessary for patient care
- Redisclose when allowed by law
Include the documents from the other hospital
Before a user is allowed to access protected health information, the system confirm that the patient is who he or she says they are. This is known as
- access control
- notification
- authorization
- authentication
authentication
Contingency planning includes which of the following processes?
- data quality
- system analysis
- disaster planning
- hiring practices
disaster planning
Which of the following disclosures would require patient authorization?
- law enforcement activities
- workers’ compensation
- release to patient’s family
- public health activities
release to patient’s family
I have been asked if I want to be in the directory. The admission clerk explains that if I am in the directory,
- my friends and family can find out my room number
- my condition can be discussed with any caller in detail.
- my condition can be released to the news media
- my condition can be released to hospital staff only.
my friends and family can find out my room number
Which of the following techniques would a facility employ for access control?
- automatic logoff
- authentication
- integrity controls
- unique user identification
- 1 and 4 only
- 1 and 2 only
- 2 and 4 only
- 3 and 4 only
1 and 4 only
Which of the following statement is true about the Privacy Act of 1974?
- It applies to all organizations that maintain health care data in any form.
- It applies to all health care organizations.
- It applies to the federal government.
- It applies to federal government except for the Veterans Health Administration
It applies to the federal government.
Which of the following statements is true about a requested restriction?
• ARRA mandates that a CE must comply with a requested restriction.
• ARRA states that a CE does not have to agree to a request restriction
• ARRA mandates that a CE must comply with a requested restriction unless it meets one of the exceptions
• ARRA does not address restrictions to PHI
ARRA mandates that a CE must comply with a requested restriction unless it meets one of the exceptions
Which of the following is an example of administrative safeguards under the security rule?
- encryption
- monitoring the computer access activity of the user
- assigning unique identifiers
- monitoring traffic on the network
monitoring the computer access activity of the user
Someone accessed the covered entity’s electronic health record and sold the information that was accessed. This person is knows as which of the following?
- malware
- a virus
- a hacker
- a cracker
a cracker
Intentional threats to security could include
- a natural disaster (flood).
- equipment failure (software failure).
- human error (data entry error).
- data theft (unauthorized downloading of files).
data theft (unauthorized downloading of files).
Which of the following would be a business associate?
- release of information company
- bulk food service provider
- childbirth class instructor
- security guards
release of information company
Which of the following statements demonstrates a violation of protected health information?
- “Can you help me find Mary Smith’s record?”
- A member of the physician’s office staff calls centralized scheduling and says, “Dr. Smith wants to perform a bunionectomy on Mary Jones next Tuesday.”
- “Mary, at work yesterday I saw that Susan had a hysterectomy.”
- Dr. Jones tells a nurse on the floor to give Ms. Brown Demerol for her pain.
“Mary, at work yesterday I saw that Susan had a hysterectomy.”
You are a nurse who works on 3West during the day shift. One day, you had to work the night shift because they were shorthanded. However, you were unable to access the EHR. What type of access control (s) are being used?
- user-based
- context-based
- role-based
- either user- or role-based
context-based
In case your system crashes, your facility has defined the policies and procedures necessary to keep your business going. This is known as:
- core operations
- business continuity plan
- data recovery
- data backup
business continuity plan
You are defining the designated record set for South Beach Healthcare Center. Which of the following should be included?
- quality reports
- psychotherapy notes
- discharge summary
- information compiled for use in civil hearing
discharge summary
You have been asked to provide examples of technical security measures. Which of the following would you include in your list of examples?
- locked doors
- automatic logout
- minimum necessary
- training
automatic logout
Which security measure utilizes fingerprints or retina scans?
- audit trail
- biometrics
- authentication
- encryption
biometrics
Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely
- psychotherapy notes
- alcohol and drug records
- AIDS records
- mental health assessment
psychotherapy notes
Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be re-created by authorized users. This technique is called.
- a firewall
- validity processing
- a call-back process
- data encryption
data encryption
When patients are able to obtain a copy of their health record, this is an example of which of the following?
- a required standard
- an addressable requirement
- a patient right
- a preemption
a patient right
Which of the following should the record destruction program include?
- the method of destruction
- the name of the supervisor of the person destroying the records
- citing the laws followed
- requirement of daily destruction
the method of destruction
You are looking for potential problems and violations of the privacy rule. What is this security management process called?
- risk management
- risk assessment
- risk aversion
- business continuity planning
risk assessment
The surgeon comes out to speak to a patient’s family. He tells them that the patient came through the surgery fine. The mass was benign and they could see the patient in an hour. He talks low so that the other people in the waiting room will not hear but someone walked by and heard. This is called a(N)
- privacy breach
- violation of policy
- incidental disclosure
- privacy incident.
incidental disclosure
A patient signed an authorization to release information to a physician but decided not to go see that physician. Can he stop the release?
- No, once the release is signed, it cannot be reversed
- Yes - in all circumstances
- Yes, as long as it has not been released already
- Yes, as long as the physician agrees
Yes, as long as it has not been released already
A mechanism to ensure that PHI has not been altered or destroyed inappropriately has been established. This process is called
- entity authentication
- audit controls
- access control
- integrity
integrity
Which of the following documents is subject to the HIPAA security rule?
- document faxed to the facility
- copy of discharge summary
- paper medical record
- scanned operative report stored on CD
scanned operative report stored on CD
The hospital has received a request for an amendment. How long does the facility have in order to accept or deny the request?
- 30 days
- 60 days
- 14 days
- 10 days
60 days
You work for a 60-bed hospital in a rural community. You are conducting research on what you need to do to comply with HIPAA. You are afraid that you will have to implement all of the steps that your friend at a 900-bed teaching hospital is implementing at his facility. You continue reading and learn that you only have to implement what is prudent and reasonable for your facility. This is called.
- scalable
- risk assessment
- technology neutral
- access control
scalable
Barbara, a nurse, has been flagged for review because she logged in to the EHR in the evening when she usually works the day shift. Why should this conduct be reviewed?
- This is a privacy violation
- This needs to be investigated before a decision is made because there may be a legitimate reason why she logged in at this time.
- This is not a violation since Barbara, as a nurse, has full access to data in the EHR
- No Action is required
This needs to be investigated before a decision is made because there may be a legitimate reason why she logged in at this time.
Alisa has trouble remembering her password. She is trying to come up with a solution that will help her remember. Which one of the following would be the BEST practice?
- using the word “password” for her password
- using her daughter’s name for her password
- writing the complex password on the last page of her calendar
- creating a password that utilizes a combination of letters and numbers
creating a password that utilizes a combination of letters and numbers
Which statement is true about when a family member can be provided with PHI?
- The patient’s mother ca always receive PHI on their child.
- The family member lives out of town and cannot come to the facility to check on the patient.
- The family member is a health care professional
- The family member is directly involved in the patient’s care
The family member is directly involved in the patient’s care
A covered entity
- is exempt from the HIPAA privacy and security rules
- includes all health care providers
- includes health care providers who perform specified actions electronically.
- must utilize business associates
includes health care providers who perform specified actions electronically.
Protected health information includes
- only electronic individually identifiable health information
- only paper individually identifiable health information
- individually identifiable health information in any format stored by a health care provider
- individually identifiable health information in any format stored by a health care provider or business associate
individually identifiable health information in any format stored by a health care provider or business associate
To prevent their network from going down, a company has duplicated much of its hardware and cables. This duplication is called
- an emergency mode plan
- redundancy
- a contingency plan
- a business continuity planning
redundancy
Richard has asked to view his medical record. Within what time-frame must the facility provide this record to him?
- 30 days
- 60 days
- 14 days
- 10 days
30 days
The HIPAA security rule impacts which of the following protected health information?
- x-ray films stored in radiology
- paper medical records
- faxed records
- clinical data repository
clinical data repository
To which of the following requesters can a facility release information about a patient without that patient’s authorization?
- the public health department
- the nurse caring for the patient
- a court with a court order
- a business associate
a court with a court order
The data on a hard drive were erased by a corrupted file that had been attached to an e-mail message. Which of the following can be used to prevent this?
- messaging standards
- acceptance testing
- virus checker
- encryption
virus checker
Which of the following is the term used to identify who made an entry into a health record?
- access control
- authentication
- authorship
- No answer text provided.
authorship
When logging into a system, you are instructed to enter a string of characters. These characters appear distorted onscreen, however. What kind of access control is this?
- CAPCHA
- biometrics
- token
- accessibility
CAPCHA
Which of the following is an example of two-factor authentication?
- username and password
- token and smart card
- fingerprint and retinal scan
- password and token
password and token
The three components of a security program are protecting the privacy of data, ensuring the integrity of data, and ensuring the _________.
- validity of data
- availability of data
- security of hardware
- security of data
availability of data
