Free CHPC Safeguarding Patient Information Questions and Answers — Questions and Answers
Question 1: What is an example of a technical safeguard under the HIPAA Security Rule?
- Conducting workforce HIPAA privacy training
- Implementing encryption for electronic Protected Health Information (ePHI) (Correct answer)
- Securing access to physical records in locked cabinets
- Conducting periodic risk assessments
Correct answer: Implementing encryption for electronic Protected Health Information (ePHI)
Technical safeguards under the HIPAA Security Rule refer to the technology and policies used to protect electronic Protected Health Information (ePHI) and control access to it. Implementing encryption for ePHI is a prime example of a technical safeguard. Encryption renders the data unreadable and unusable to unauthorized individuals, significantly enhancing its security during transmission and storage.
Question 2: A hospital employee leaves a laptop containing unencrypted ePHI in their car, and it is stolen. What must the organization do under the HIPAA Breach Notification Rule?
- Do nothing if the car was locked
- Notify affected individuals, the OCR, and possibly the media (Correct answer)
- Wait to see if the data is accessed before taking action
- Only notify individuals if more than 500 records are involved
Correct answer: Notify affected individuals, the OCR, and possibly the media
This scenario describes a breach of unsecured ePHI, as the laptop was unencrypted and stolen. Under the HIPAA Breach Notification Rule, organizations must notify affected individuals without unreasonable delay. If the breach affects 500 or more individuals, notification to the OCR and the media is also required, making this the comprehensive correct action.
Question 3: Which of the following is NOT required as a physical safeguard under HIPAA?
- Limiting access to areas containing PHI
- Installing security cameras to monitor PHI access
- Keeping printed medical records in locked storage
- Encrypting PHI stored on mobile devices (Correct answer)
Correct answer: Encrypting PHI stored on mobile devices
Encryption of PHI stored on mobile devices is classified as a technical safeguard under HIPAA, not a physical safeguard. Physical safeguards focus on protecting physical access to electronic information systems and the facilities that house them, such as limiting access to areas and securing physical records. Technical safeguards, like encryption, protect ePHI within electronic systems by controlling access and ensuring data integrity.
Question 4: A nurse accesses the electronic health record (EHR) of a friend who is admitted to the hospital without a work-related reason. <br> What type of safeguard failure does this represent?
- Physical safeguard failure
- Physical safeguard failure (Correct answer)
- Administrative safeguard failure
- There is no failure if the nurse does not share the information Answer: B
Correct answer: Physical safeguard failure
This scenario could be considered a physical safeguard failure if the nurse gained access to the EHR through a workstation that was not adequately secured according to the organization's physical safeguard policies. For example, if a workstation was left logged in or in an area accessible to the nurse without proper authorization, allowing them to physically sit down and access the system. While the act of accessing the data is electronic, the vulnerability could stem from a lack of physical workstation security.
Question 5: What is the best way to safeguard PHI on mobile devices such as laptops or smartphones?
- Implementing encryption for PHI (Correct answer)
- Installing antivirus software and firewalls (Correct answer)
- Using strong passwords or biometric authentication
- Allowing unrestricted use of personal devices for PHI access
Correct answer: Implementing encryption for PHI
Implementing encryption for PHI is considered the best way to safeguard data on mobile devices. Encryption renders the information unreadable and unusable to unauthorized individuals if the device is lost or stolen, providing a strong layer of protection directly to the data itself. While other measures like strong passwords and antivirus are important, encryption directly addresses the risk of data compromise.
Free CHPC Safeguarding Patient Information Questions and Answers
What is an example of a technical safeguard under the HIPAA Security Rule?