CMRT Privacy & Security 3 — Questions and Answers
Question 1: Which federal law specifically protects the confidentiality of substance use disorder treatment records beyond standard HIPAA protections?
- FERPA
- 42 CFR Part 2 (Correct answer)
- The Privacy Act of 1974
- The HITECH Act
Correct answer: 42 CFR Part 2
42 CFR Part 2 provides heightened confidentiality protections for records of patients treated for substance use disorders at federally assisted programs.
Question 2: Under the HITECH Act, breach notifications to affected individuals must be sent within:
- 30 days of discovery
- 60 days of discovery (Correct answer)
- 90 days of discovery
- 6 months of discovery
Correct answer: 60 days of discovery
HITECH requires covered entities to notify affected individuals of a breach without unreasonable delay and no later than 60 calendar days from discovery.
Question 3: An EHR audit log is primarily used to:
- Back up patient records to a secondary server
- Track who accessed, modified, or deleted records and when (Correct answer)
- Encrypt PHI transmitted over networks
- Authenticate user passwords during login
Correct answer: Track who accessed, modified, or deleted records and when
Audit logs record access activity, enabling organizations to detect unauthorized access, modifications, or deletions of electronic health records.
Question 4: A workforce member who accesses a colleague's health record out of curiosity — without a work-related need — is committing:
- An incidental disclosure
- A HIPAA privacy violation (Correct answer)
- A breach notification exemption
- A de minimis security exception
Correct answer: A HIPAA privacy violation
Unauthorized access to PHI without a valid work-related reason violates the HIPAA Privacy Rule's minimum necessary and access control requirements.
Question 5: Which entity is responsible for enforcing HIPAA compliance?
- The Joint Commission
- The Department of Health and Human Services Office for Civil Rights (OCR) (Correct answer)
- The Centers for Medicare & Medicaid Services (CMS)
- The American Health Information Management Association (AHIMA)
Correct answer: The Department of Health and Human Services Office for Civil Rights (OCR)
The HHS Office for Civil Rights (OCR) is the primary federal agency that investigates HIPAA complaints and enforces compliance.
Question 6: Role-based access control (RBAC) in a health information system means:
- Each user creates a unique password at least 12 characters long
- System access is granted based on a user's job function, not individual identity (Correct answer)
- All staff have equal access to all records within the system
- Patients can access any provider's records across the organization
Correct answer: System access is granted based on a user's job function, not individual identity
RBAC limits system access to the minimum PHI needed for each staff role, reducing the risk of unauthorized access.
Question 7: What is 'shoulder surfing' in the context of health information security?
- A method of encrypting data during electronic transmission
- Viewing a computer screen or document without authorization by looking over someone's shoulder (Correct answer)
- An attack that floods a network with traffic to cause downtime
- A technique for recovering lost health records from backup media
Correct answer: Viewing a computer screen or document without authorization by looking over someone's shoulder
Shoulder surfing is a physical security threat where an unauthorized person views sensitive information by observing a worker's screen or paper documents.
CMRT Privacy & Security 3
Which federal law specifically protects the confidentiality of substance use disorder treatment records beyond standard HIPAA protections?