PHI Safeguards - Mpje

1. Which HIPAA Security Rule safeguard category includes workforce training and sanctions?

   Administrative safeguards. These safeguards focus on policies, procedures, and management to ensure workforce compliance and security awareness.

2. What is the definition of a HIPAA breach (general rule) for unsecured PHI?

   Impermissible use or disclosure that compromises PHI security or privacy. This definition identifies incidents posing significant risk to PHI, triggering notification requirements if unsecured.

3. Which HIPAA Security Rule safeguard category includes access control, audit controls, and transmission security?

   Technical safeguards. These involve technology-based mechanisms to control access, monitor activity, and secure data transmission.

4. What is the maximum time allowed to notify a covered entity after a business associate discovers a breach?

   No later than $60$ days from discovery. This deadline ensures covered entities receive timely information to fulfill their notification obligations.

5. What is the immediate first step after discovering a potential PHI incident in a pharmacy?

   Mitigate/contain and begin an incident assessment. Immediate mitigation limits harm, while assessment determines if the incident constitutes a reportable breach.

6. What is the HIPAA Privacy Rule scope regarding PHI format (paper, oral, electronic)?

   It applies to PHI in any form (paper, oral, electronic). The Privacy Rule encompasses all PHI formats to ensure broad protection of patient information regardless of medium.

7. Which notification is required when a breach affects $500$ or more residents of a state/jurisdiction?

   Notify HHS contemporaneously (without delay, no later than $60$ days). Contemporaneous notification for larger breaches enables prompt HHS investigation and public awareness.

8. What is the required HIPAA Security Rule foundational activity that drives safeguards?

   An accurate and thorough risk analysis. Risk analysis identifies potential vulnerabilities, informing the implementation of appropriate safeguards under the Security Rule.

9. What HIPAA Security Rule concept limits ePHI access to authorized persons or software programs?

   Confidentiality. Confidentiality restricts ePHI to authorized users, protecting against unauthorized access or disclosure.

10. What HIPAA Security Rule concept ensures ePHI is accessible and usable on demand?

    Availability. Availability ensures reliable access to ePHI, supporting continuity of care and operations.

11. Identify the HIPAA breach-notification deadline to affected individuals after discovery.

    Without unreasonable delay and no later than $60$ days. This timeline ensures timely notification to allow individuals to protect themselves from potential harm.

12. Which safeguard type best fits encrypting ePHI in transit (for example, email or network transmission)?

    Technical safeguard (transmission security/encryption). Encryption during transmission prevents unauthorized interception, aligning with technical integrity and confidentiality requirements.

13. What are the three required HIPAA safeguard categories for protecting electronic PHI?

    Administrative, physical, and technical safeguards. HIPAA Security Rule categorizes protections into these three areas to comprehensively secure ePHI against threats.

14. What are the four required HIPAA breach risk-assessment factors (list in any order)?

    PHI nature; unauthorized person; acquisition/viewing; mitigation extent. These factors assess breach risk by considering PHI sensitivity, recipient, exposure, and remedial actions.

15. What is the HIPAA Security Rule scope regarding PHI format (paper, oral, electronic)?

    It applies only to electronic PHI (ePHI). The Security Rule focuses exclusively on electronic formats to address digital vulnerabilities in PHI handling.

16. Which notification is required when a breach affects fewer than $500$ residents of a state/jurisdiction?

    Notify HHS annually (log) within $60$ days after year end. Annual logging for smaller breaches allows efficient HHS oversight without immediate reporting burdens.

17. Which HIPAA Security Rule safeguard category includes facility access controls and workstation security?

    Physical safeguards. These measures protect physical access to ePHI, preventing unauthorized entry or tampering with hardware.

18. What is the HIPAA definition of "discovery" of a breach for starting notification timelines?

    When known or should have been known with reasonable diligence. Discovery is based on actual or constructive knowledge to prevent delays in breach response timelines.

19. What HIPAA Security Rule concept ensures ePHI is not improperly altered or destroyed?

    Integrity. Integrity mechanisms prevent unauthorized alterations, maintaining the accuracy and reliability of ePHI.

20. When is media notice required for a HIPAA breach, and what is the threshold?

    If $500$ or more residents in a state/jurisdiction are affected. Media notice is mandated for large-scale breaches to inform the public when individual notifications may be insufficient.

21. What is the HIPAA Security Rule standard that requires unique user identification?

    Access control (unique user identification). Unique IDs enable tracking and limiting access to ePHI, ensuring accountability under technical safeguards.

22. What is the HIPAA Security Rule required approach to safeguards (specific tech vs flexible)?

    Flexible, scalable safeguards based on risk analysis. The rule allows entities to tailor protections to their size, complexity, and risks rather than mandating specific technologies.

23. What is the HIPAA standard used to decide if an impermissible use/disclosure is a breach?

    Low probability of compromise based on a risk assessment. Risk assessment evaluates compromise likelihood to determine if notification is required under HIPAA.

24. What is the HIPAA Security Rule standard that requires hardware, software, and procedural recording of activity?

    Audit controls. Audit controls monitor and record system activity to detect and investigate potential security incidents.

25. What is the HIPAA presumption for an impermissible disclosure unless an exception or low risk is shown?

    It is presumed to be a breach. The presumption shifts the burden to demonstrate low risk, ensuring thorough evaluation of incidents.

Study these flashcards