RHIT - Registered Health Information Technician HIPAA Privacy and Security 2 — Questions and Answers
Question 1: What is the difference between HIPAA's Privacy Rule and Security Rule?
- They are the same rule
- The Privacy Rule governs use and disclosure of all PHI while the Security Rule addresses protection of electronic PHI (Correct answer)
- The Privacy Rule applies to hospitals and the Security Rule to clinics
- The Security Rule replaced the Privacy Rule
Correct answer: The Privacy Rule governs use and disclosure of all PHI while the Security Rule addresses protection of electronic PHI
The Privacy Rule covers all forms of PHI; the Security Rule specifically addresses ePHI protection through three safeguard categories.
The Security Rule has three safeguard categories: administrative (policies, training), physical (facility access, workstation security), and technical (access controls, encryption, audit controls).
Question 2: A patient requests access to their complete medical record. Within what timeframe must the covered entity respond?
- Immediately
- Within 30 days, with one 30-day extension if needed (Correct answer)
- Within 90 days
- There is no required timeframe
Correct answer: Within 30 days, with one 30-day extension if needed
HIPAA requires action within 30 days with one possible 30-day extension.
Limited exceptions to access exist for psychotherapy notes, information compiled for legal proceedings, and certain research records. OCR has made Right of Access a priority.
Question 3: What constitutes a 'breach' under the HIPAA Breach Notification Rule?
- Any access to a patient's record
- An impermissible use or disclosure of PHI that compromises security or privacy (Correct answer)
- A scheduled system maintenance window
- A patient requesting their own records
Correct answer: An impermissible use or disclosure of PHI that compromises security or privacy
A breach is an impermissible use or disclosure that compromises PHI security or privacy.
Three exceptions exist: unintentional acquisition in good faith, inadvertent disclosure between authorized persons, and disclosures where the recipient couldn't reasonably retain the information.
Question 4: Which HIPAA Security Rule safeguard category includes workforce training?
- Technical safeguards
- Physical safeguards
- Administrative safeguards (Correct answer)
- Organizational requirements
Correct answer: Administrative safeguards
Security awareness and training is an administrative safeguard.
Administrative safeguards include security management, assigned security responsibility, workforce security, information access management, training, incident procedures, contingency plan, and evaluation.
Question 5: What is the HIPAA 'accounting of disclosures' requirement?
- An accounting of financial transactions
- The right of patients to receive a list of certain disclosures of their PHI during the prior six years (Correct answer)
- A record of employee access to the building
- An inventory of computer equipment
Correct answer: The right of patients to receive a list of certain disclosures of their PHI during the prior six years
Patients can request an accounting of PHI disclosures made in the six years prior to the request.
Disclosures for TPO, to the individual, pursuant to authorization, and for national security are excluded. The first accounting in any 12-month period must be free.
Question 6: What is encryption and why is it important for ePHI?
- A type of antivirus software
- Converting data into an unreadable coded format that can only be decoded with the proper key (Correct answer)
- Deleting data after a set period
- Only used for email communication
Correct answer: Converting data into an unreadable coded format that can only be decoded with the proper key
Encryption transforms readable data into an unreadable format using an algorithm and key.
Encrypted PHI that is breached does not require notification if encryption meets NIST standards and the key was not compromised (safe harbor provision).
RHIT - Registered Health Information Technician HIPAA Privacy and Security 2
What is the difference between HIPAA's Privacy Rule and Security Rule?