NHA CEHRS Quiz 4: Regulatory Compliance

In order to limit the use of, disclosure of, and request for protected health information (PHI), the HIPAA Privacy Rule requires covered entities to adhere to which of the following concepts?

• Technical Safeguards

• Addressable Standard

• Minimum Necessary

• Required Standard

For which of the following reasons was the Security Standards Matrix created by the Centers for Medicare and Medicaid Services (CMS)?

• Facilitating the auditing process of EHR systems.

• Tracking breaches in the security of facility EHRs.

• Determining if passwords were being routinely changed within institutions.

• Ensuring that covered entities assess their compliance with the HIPAA Security Rule.

An EHR specialist is preparing to enter patient information into the EHR. Which of the following actions should the EHR specialist take to maintain the security of protected health information (PHI)?

• Use a personal computer to store patient information.

• Log off the EHR system when not in use.

• Communicate patient PHI via personal email.

• Use the provider's EHR login information when recording data.

Which of the following parts of the EHR indicates if a health record documentation has been modified?

• User Activity Feed

• Reports

• Messages

• Patient Tracker

An EHR specialist is education a newly hired staff member about safeguarding patient information in the EHR. Which of the following statements should the EHR specialist make?

• "Disabling automatic EHR system logoff enhances efficiency and security."

• "Demographic information is not considered part of a patient's EHR."

• "We are authorized to share EHR system passwords when necessary."

• "Biometric measurements are acceptable for individual identification for EHR system access."

Which of the following behaviors should an EHR specialist identify as a threat to data security when transmitting electronic patient health information?

• Using initials when referring to a patient.

• Sending an unencrypted email to a pharmacy.

• Supplying a patient's room number to the provider.

• De-identifying patient data sent to a research company.