Safety & Infection Control Flashcards

A healthcare organization's contingency plan must address maintaining access to ePHI during facility emergencies such as a fire or infectious disease outbreak. This plan is primarily required by which HIPAA standard?

Answer: Administrative Safeguards — Contingency Plan

The Contingency Plan standard under Administrative Safeguards (45 CFR § 164.308(a)(7)) requires covered entities to have policies for responding to emergencies that damage systems containing ePHI.

During an infectious disease emergency, a hospital activates its Emergency Operations Plan. Staff begin photographing patient wristbands with personal phones to track patient locations. This practice:

Answer: Likely violates HIPAA unless the organization has a policy addressing PHI capture on personal devices during emergencies

Even during emergencies, PHI captured on personal devices must be governed by organizational policy; the lack of such a policy and controls likely constitutes a HIPAA violation.

Which federal law works alongside HIPAA to specifically address the protection of individually identifiable health information collected during public health disease reporting?

Answer: The Public Health Service Act (PHSA)

The Public Health Service Act authorizes federal public health activities and works alongside HIPAA's public health exception to allow disease reporting while protecting individual privacy.

A CHP candidate is asked about the 'minimum necessary' standard as it applies to infection control disclosures. Which scenario BEST exemplifies compliance with this standard?

Answer: Disclosing only the patient's diagnosis, date of onset, and relevant demographic information required by the health department's disease report form

The Minimum Necessary standard requires disclosing only the PHI needed to accomplish the intended purpose, which in disease reporting means providing only the data fields required on the official report.

A long-term care facility is conducting an internal audit of its infection control logs, which contain resident names and diagnoses. These logs are used only for internal quality improvement. Under HIPAA, this use:

Answer: Is permitted as a healthcare operations activity, provided access is limited to authorized personnel with a need to know

Internal quality improvement activities, including infection control auditing, fall within HIPAA's healthcare operations exception, though access must still be appropriately controlled.

A healthcare security officer is evaluating risks associated with portable diagnostic equipment moved between COVID-19 isolation rooms and general patient areas. The HIPAA risk analysis for this equipment should consider:

Answer: Both the potential for ePHI on the device to be accessed without authorization AND the infection control protocols needed to safely handle the device between uses

A comprehensive risk analysis must consider all threats to ePHI confidentiality, integrity, and availability, including how the device is physically handled between patient encounters and the risk of unauthorized access during transport.

After an infectious disease exposure event in a clinic, the facility must notify affected patients. If the notification process involves mailing letters to patients, which HIPAA requirement governs how these communications must be sent?

Answer: Notifications must be sent to the patient's last known address using a method that provides reasonable confidentiality, consistent with the HIPAA Breach Notification Rule

The HIPAA Breach Notification Rule requires written notice sent by first-class mail (or email if the individual agreed) to the individual's last known address within 60 days of discovery.