BCP Test Security and Data Management Questions and Answers 1 — Questions and Answers
Question 1: A psychometrist needs to transport a neuropsychological test kit, including stimulus books and manuals, from the main clinic to a satellite office. Which of the following represents the most secure method of transport?
- Placing the materials in a sealed box in the trunk of their car.
- Mailing the materials to the satellite office using a standard postal service.
- Carrying the materials in a standard, open-top tote bag for easy access.
- Placing the materials in a locked briefcase or bag that remains in the psychometrist's possession at all times. (Correct answer)
Correct answer: Placing the materials in a locked briefcase or bag that remains in the psychometrist's possession at all times.
Test materials are confidential and must be secured to maintain their integrity. A locked container that remains in the psychometrist's direct possession prevents loss, theft, and unauthorized access. Leaving materials in a car (even in the trunk) poses a risk of theft, an open bag is not secure, and standard mail lacks the necessary security and chain of custody for such sensitive materials.
Question 2: In the United States, what is the primary purpose of the HIPAA Security Rule as it pertains to patient data management?
- To set national standards for the security of electronic protected health information (e-PHI). (Correct answer)
- To define the legal penalties for all types of medical malpractice.
- To mandate the use of specific electronic health record (EHR) software across all healthcare providers.
- To set standards for protecting individuals' rights to access and amend their paper-based health information.
Correct answer: To set national standards for the security of electronic protected health information (e-PHI).
The HIPAA Security Rule specifically establishes national standards for protecting electronic protected health information (e-PHI) by requiring administrative, physical, and technical safeguards. It is distinct from the Privacy Rule, which covers PHI in all formats, and it does not mandate specific software or govern malpractice penalties.
Question 3: Which of the following is the most ethically and legally sound method for disposing of outdated psychological test record forms that contain protected health information (PHI)?
- Placing the forms in a standard office recycling bin after redacting patient names.
- Cross-cut shredding the forms to ensure the information is unrecoverable. (Correct answer)
- Storing the documents indefinitely in a locked file cabinet.
- Burning the documents in a public-access incinerator.
Correct answer: Cross-cut shredding the forms to ensure the information is unrecoverable.
To comply with HIPAA and ethical standards, documents containing PHI must be destroyed in a way that makes them unreadable and unreconstructible. Cross-cut shredding is the most common and accepted method for achieving this in an office setting. Redacting, recycling, or simple trashing does not provide sufficient protection. While indefinite storage might be secure, proper disposal of outdated records is a key part of the data lifecycle.
Question 4: While browsing a professional social media group, a psychometrist finds a post where another user has uploaded a photograph of a stimulus item from a widely used, copyrighted intelligence scale. What is the psychometrist's primary ethical obligation?
- Comment on the post with the correct scoring information to help the user.
- Report the post to the group administrator and notify the test publisher of the security breach. (Correct answer)
- Ignore the post to avoid drawing more attention to the breach of security.
- Take a screenshot of the item for their own reference and training purposes.
Correct answer: Report the post to the group administrator and notify the test publisher of the security breach.
The primary ethical duty is to protect the integrity and security of psychological tests. Publicly posting copyrighted material compromises the test's validity for future examinees. The correct action is to take steps to have the material removed (reporting to the administrator) and to inform the owner of the intellectual property (the test publisher) so they can take further action.
Question 5: A supervising psychologist asks a psychometrist to prepare a patient dataset for a research study. To protect patient privacy according to the HIPAA Safe Harbor method, what is the most critical step?
- Ensuring the data is stored on a password-protected computer.
- Deleting all raw scores and only including the final summary scores.
- De-identifying the data by removing all 18 specified personal identifiers. (Correct answer)
- Assigning a random number to each patient but keeping a separate key to link the numbers to names.
Correct answer: De-identifying the data by removing all 18 specified personal identifiers.
The HIPAA Safe Harbor method requires the removal of all 18 specified personal identifiers (e.g., name, specific dates, geographic subdivisions smaller than a state, etc.) to consider data de-identified. While password protection is a necessary security measure, it does not de-identify the data itself. Keeping a linking key means the data is coded, not fully anonymized under this method.
Question 6: A psychometrist receives a subpoena from an attorney requesting the complete test protocol for a former patient, including raw data and specific responses. The psychometrist is unable to contact the patient to obtain a release of information. What is the most appropriate initial action?
- Immediately comply with the subpoena and send all requested materials to the attorney.
- Contact the attorney directly to explain that raw test data cannot be released under any circumstances.
- Refuse to comply, citing patient confidentiality, and inform the supervisor.
- Consult with the supervising psychologist and the organization's legal counsel before taking any action. (Correct answer)
Correct answer: Consult with the supervising psychologist and the organization's legal counsel before taking any action.
A subpoena is a legal demand, but releasing protected health information and copyrighted test materials requires careful handling. The proper procedure is not to act unilaterally but to involve the supervising psychologist and legal counsel to determine the correct legal and ethical response, which may involve seeking a protective court order or asserting privilege before releasing any information.
BCP Test Security and Data Management Questions and Answers 1
A psychometrist needs to transport a neuropsychological test kit, including stimulus books and manuals, from the main clinic to a satellite office.
Which of the following represents the most secure method of transport?