DOMAIN 2:Access, Disclosure, Privacy, and Security

Which of the following definitions best describes the concept of confidentiality?

• The expectation that personal information shared by an individual with a healthcare provider during the individual’s care will be used only for its intended purpose

• The protection of healthcare information from damage, loss, and unauthorized alteration

• The right of individuals to control access to their personal health information

• The expectation that only individuals with the appropriate authority will be allowed to access healthcare information

Which of the following is an example of a physical safeguard that should be provided for in a data security program?

• Using password protection

• Prohibiting the sharing of passwords

• Locking computer rooms

• Annual employee training

Which of the following is true regarding the development of health record destruction policies?

• All applicable laws must be considered

• The organization must find a way not to destroy any health records

• Health records involved in pending or ongoing litigation may be destroyed

• Only state laws must be considered

A health information technician receives a subpoena ad testificandum. To respond to the subpoena, which of the following should the technician do?

• Review the subpoena to determine what documents must be produced

• Review the subpoena and notify the hospital administrator

• Review the subpoena and appear at the time and place supplied to give testimony

• Review the subpoena and alert the hospital’s risk management department

The right of an individual to keep personal health information from being disclosed to anyone is a definition of:

• Confidentiality

• Integrity

• Privacy

• Security

Community Hospital is terminating its business associate relationship with a medical transcription company. The transcription company has no further need for any identifiable information that it may have obtained in the course of its business with the hospital. The CFO of the hospital believes that to be HIPAA compliant, all that is necessary is for the termination to be in a formal letter signed by the CEO. In this case, how should the director of HIM advise the CFO?

• Determine that a formal letter of termination meets HIPAA requirements and no further action is required

• Confirm that a formal letter of termination meets HIPAA requirements and no further action is required except that the termination notice needs to be retained for seven years

• Confirm that a formal letter of termination is required and that the transcription company must provide the hospital with a certification that all PHI that it had in its possession has been destroyed or returned

• Inform the CFO that business associate agreements cannot be terminated

The Medical Record Committee is reviewing the privacy policies for a large outpatient clinic. One of the members of the committee remarks that he feels the clinic’s practice of calling out a patient’s full name in the waiting room is not in compliance with HIPAA regulations and that only the patient’s first name should be used. Other committee members disagree with this assessment. What should the HIM director advise the committee?

• HIPAA does not allow a patient’s name to be announced in a waiting room.

• There is no violation of HIPAA in announcing a patient's name, but the committee may want to consider implementing a change that might reduce this practice.

• HIPAA allows only the use of the patient’s first name.

• HIPAA requires that patients be given numbers and only the number be announced.

Which of the following statements is true regarding HIPAA security?

• All institutions must implement the same security measures.

• Institutions are allowed flexibility in the way they implement HIPAA standards.

• All institutions must implement all HIPAA specifications.

• A security risk assessment must be performed every year.

An external security threat can be caused by which of the following?

• Employees who steal data during work hours

• A facility’s water pipes bursting

• Tornadoes

• The failure of a facility’s software

An employee accesses PHI on a computer system that does not relate to her job functions. What security mechanism should have been implemented to minimize this security breach?

• Access controls

• Audit controls

• Contingency controls

• Security incident controls