RHIT Practice Domain 2 Access, Disclosure, Privacy, and Security

At Wildcat Hospital, paper-based documents not already included in the EHR are scanned into the EHR at the time of discharge. These paper-based documents are then stored for 60 days before being destroyed. Which of the following statements is true?

• The scanned documents do not need to added to the patient’s EHR.

• The scanned documents can never be part of the legal record so we should not destroy the paper documentation.

• The scanned documents become part of the legal record as soon as the original documentation is destroyed.

• The paper-based documentation must be retained for the statute of limitations.

An admitting clerk arrives early every morning to snoop through the EHR for information about neighbors and friends. What security mechanisms could minimize this security breach?

• Information access controls

• Facility access controls

• Audit controls

• Workstation security

Sally Mitchell was treated for kidney stones at Graham Hospital last year. She now wants to review her health record in person. She has requested to review it by herself in a private room. Which of the following is true based on this scenario?

• Sally’s request does not have to be granted because the hospital is responsible for the integrity of the health record.

• Failure to accommodate her wishes will be a violation under the HIPAA Privacy Rule.

• Sally owns the information in her record, so she must be granted her request.

• Patients should never be given access to their actual health records.

The outpatient clinic of a large hospital is reviewing its patient sign-in procedures. The registration clerks say it is essential that they know if the patient has health insurance and the reason for the patient’s visit. The clerks maintain having this information on a sign-in sheet will make their jobs more efficient and reduce patient waiting time in the waiting room. What should the HIM director advise in this case?

• Patient name, insurance status, and diagnoses are permitted by HIPAA.

• To be HIPAA compliant, sign-in sheets should contain the minimum information necessary such as patient name only.

• Patient name, insurance status, and the reason for the visit would be considered incidental.

An employee observes a non-employee putting a flash drive in a bag. The employee does not report this security breach. What security measures should have been in place to help ensure that such a case is reported?

• Access controls

• Audit controls

• Authentication controls

• Security incident procedures

Which of the following would be used to encode textual material and convert it to scrambled data that must be decoded for the recipient to understand it?

• Encoding

• Encryption

• Firewall

• Virtual private network

A visitor walks through the IT department and picks up a flash drive from an employee’s desk. What security controls should have been implemented to prevent this security breach?

• Workstation security controls

• Facility access controls

• Workstation use controls

• Device and media controls

For which of the following is an audit trail not a good tool?

• Holding an individual employee accountable for actions

• Reconstructing electronic events

• Detecting a hacker

• Determining revenue from a particular DRG

A health information management professional may attend legal proceedings and testify as to:

• The reason a patient was treated

• Reasons a defendant healthcare provider should not be sued

• The authenticity of the patient’s health record

• The medical necessity of any procedures performed

A legal hold serves to:

• Confine a person in jail

• Preserve information

• Create information

• Subject records to a search warrant