A business associates can be which of the following?
- medical supply delivery person
- third party IT personnel
- subcontractors
- organizations w/ data transmission services + store data/organizations
- vendors that manage personal health records
HIPPA covered entity (CE) is which of the following?
ALL OF ABOVE
Health care provider, health plan, health care clearinghouse
(T/F) If an agreement is not in place, BAs are not required to follow HIPAA
FALSE
HIPAA scenario // medial office billing calls patient but not there // talks to spouse about issue but no signed authorization from patient to allow disclosure
HAS HIPAA BEEN VIOLATED? (Y/N)
YES
YES
NO
(T/F) The goal of HIPAA privacy rule is to protect the health information of patients and restrict the flow of information in treatment.
FALSE
the minimum necessary rule of the hipaa privacy rule encourages
ALL Above
- identify which pieces of PHI need+will be accessed
- CEs and BAs determine who needs to have access to what information to perform the duties of their job
Which of the following is PHI that is not required to be given to an individual when requested?
Psychotherapy notes
Who is considered an "Actor" under the ONC Cures Act Final Rule?
All the Above
- Healthcare providers
- Health IT developers
- Health information exchanges
- Hospitals
If the State Law is more stringent than the HIPAA Privacy Law, the:
The State Law Prevails
Which of the following are considered Administrative Safeguards?
- assigned security responsibilities
- business associate contracts
- contingency plan
- evaluation
(T/F) The Security Rule's main goal was to protect PHI while still allowing for technical advancements in patient care.
True
What is not a safeguard covered under HiPAA Security Rule?
Patient Safeguards
What are safeguards covered under HiPAA Security Rule?
Administrative/Physical/Technical Safeguards
What is recommended for data that is being transmitted electronically?
encrypt all data
willful neglect
conscious failure or reckless indifference to comply with administrative simplification provision
3 exceptions to the definition of breach
If more than ___ people in a state or jurisdiction are affected by a breach, the Covered Entity must provide notice to prominent media in the area.
500
How soon after the breach must notification be given if more than 500 patent's information was exposed?
60 days
Which of the following are tiers of penalties for violations
- unknowing
- resonable cause
- willful neglect (corrected)
- willful neglect (uncorrected)