Deck 4: Security Rule Explained

Question 1

Closed circuit cameras are mandated by HIPAA Security Rule.

Answer 1

False

Question 2

Security and Privacy of protected health information really cover the same issues.

Answer 2

False

Question 3

The Office of HIPAA Standards may not initiate an investigation without receiving a formal complaint.

Answer 3

False

Question 4

Which are the five areas the DHHS has mandated each covered entity to address so that e-PHI is maintained securely?

A) Organization requirements; policies, procedures, and documentation; technical safeguards; administrative safeguards; and physical safeguards
B) Unique identifiers; administrative safeguards; technical safeguards; physical safeguards; and electronic signatures
C) Administrative safeguards; physical safeguards; policies, procedures, and documentation; a HIPAA Security Officer in charge; and a complex computer data backup system
D) Policies, procedures, and documentation; organization requirements; protected wireless access; secure firewalls; and virus protection

Question 5

One good requirement to ensure secure access control is to install automatic logoff at each workstation.

Question 6

To protect e-PHI that is sent through the Internet, a covered entity must use encryption technology to minimize the risks. E-PHI that is "at rest" must also be encrypted to maintain security.

Question 7

Access privilege to protected health information is

A) having the ability to enter a facility where paper medical records are kept.
B) what allows an individual to enter a computer system for an authorized purpose.
C) finding a password to gain access to medical information.
D) permitted only to the HIPAA Officer and the computer technicians.

Question 8

The Security Rule requires that all paper files of medical records be copied and kept securely locked up.

Question 9

If a business visitor is also a Business Associate, that individual does not need to be escorted in the building to ensure protection of PHI.

Question 10

The Centers for Medicare and Medicaid Services (CMS) have information on their Web site to help a HIPAA Security Officer know the required and addressable areas of securing e-PHI.

Question 11

Requirements that are addressable under the Security Rule may be omitted by the Security Officer.

Question 12

Compliance to the Security Rule is solely the responsibility of the Security Officer.

Question 13

HIPAA Security Rule applies to data contained in

A) unrecorded video teleconferencing.
B) any computer storage media.
C) voicemail messages
D) paper-to-paper faxes.

Question 14

Keeping e-PHI secure includes which of the following:

A) the HIPAA Security Officer has placed limits on what information is viewed by Business Associates determined by their job description.
B) policies and procedures are written to protect against unlawful access by administration.
C) changing the passwords for computer access every 30 days.
D) safeguards are in place to protect it against unauthorized access or loss.

Question 15

Security of e-PHI has to do with keeping the data secure from a breach in the information system's security protocols.

Question 16

Only a serious security incident is to be documented and measures taken to limit further disclosure.

Question 17

Risk management for the HIPAA Security Officer is a "one-time" task.

Question 18

The Office of HIPAA Standards seeks voluntary compliance to the Security Rule.

Question 19

"At home" workers such as transcriptionists are not required to follow the workstation security rules for passwords, viewing of monitors by others, or locking of computer screens.

Question 20

Only monetary fines may be levied for violation under the HIPAA Security Rule.

Question 21

Risk analysis in the Security Rule considers

A) when the Security Officer includes budget items to pay for a better computer system.
B) how hard it is for hackers to access the computer system.
C) a balance between what is cost-effective and the potential risks of disclosure.
D) the cost of insurance to cover possible losses.

Question 22

The ability to continue after a disaster of some kind is a requirement of Security Rule. What item is considered part of the contingency plan or business continuity plan?

A) Regular biohazard drills
B) Risk analysis
C) Emergency mode operation plan
D) Find someone to figure the payroll

Question 23

The Security Rule addresses four areas in order to provide sufficient physical safeguards. Which of the following is NOT one of them?

A) Workstation security
B) Device and media controls
C) Facility access controls
D) Electronic signatures
E) Workstation location and access

Question 24

Which of the following items is a technical safeguard of the Security Rule?

A) Workstation location
B) Data backup plan
C) Sufficient storage capacity
D) Entity authentication

Question 25

The act of changing readable text into a vast series of "garbled" characters using complex mathematical algorithms is called

A) decoded messages.
B) transmission architecture.
C) HIPAA protocol.
D) encryption.

Question 26

The required areas of the Security Rule

A) must be met with documentation being optional since everyone must comply.
B) must be achieved and documented.
C) may be met with a "reasonable and appropriate" approach.
D) are the administrative and technical safeguards.

Question 27

Integrity of e-PHI requires confirmation that the data

A) has been backed up routinely.
B) is accurate and has not been altered, lost, or destroyed in an unauthorized manner.
C) has accepted all changes and modifications to the medical record.
D) has been reviewed by the Security Officer as being accurate.

Question 28

What step is part of reporting of security incidents?

A) Report disclosure to all patients.
B) Notation of incident is to be excluded from the patient's medical record.
C) Notify Business Associates and Trading Partners of the breach.
D) Change passwords to protect from further invasion.

Question 29

The Security Officer is responsible to review all

A) Business Associate contracts for compliancy issues.
B) Trading Partner agreements to ensure they are fully complying with HIPAA rules.
C) Both A and B as required by Organization Requirements of Security Rule.
D) Neither A nor B in order to comply with the Security Rule.

Question 30

Business Associate contracts must include:

A) wording that protects the integrity of HIPAA standard transmissions.
B) assurance that each covered entity will use the HIPAA identifiers in transmissions.
C) implementation of safeguards to ensure data integrity.
D) only items as related to the Privacy Rule.

Question 31

Telemedicine videoconference tapes are

A) never covered by HIPAA Security Rule.
B) covered by HIPAA Security Rule if they are not erased after the physician's report is signed.
C) covered by HIPAA Security Rule only if the patient has not signed a consent form.
D) not covered by HIPAA Security Rule if used to train medical students.

Question 32

The Security Officer is to keep record of

A) all computer hardware and software used within the facility when it comes in and when it goes out of the facility.
B) just the addition of hardware and software within the facility to be sure they are compliant with the Security Rule.
C) just the removal of hardware and software within the facility to be sure all data is removed.
D) the net value of disposed equipment that the facility has removed from use.

Question 33

The documentation for policies and procedures of the Security Rule must be kept for

A) 3 years.
B) 5 years.
C) 6 years.
D) until the next fiscal year.

Question 34

To ensure minimum opportunity to access data, passwords

A) need to be changed once a year.
B) should be lengthened when staff changes position.
C) can be any four letters in a person's name for ease of remembering.
D) should be changed every ninety days or sooner.

Question 35

Reasonable physical safeguards for patient care areas include:

A) a staff escort at all times.
B) having monitors turned away from viewing by visitors.
C) have a sign-in and sign-out register for all visitors.
D) provide all visitors with your policy document.

Question 36

Record of HIPAA training is to maintained by a health care provider for

A) 4 years.
B) 6 years.
C) 7 years.
D) an indefinite time.

Question 37

Responsibilities of the HIPAA Security Officer include

A) making recommendations for new computers and seeing that they are configured to ensure secure e-PHI.
B) developing and implementing policies and procedures for the facility.
C) overseeing the training of new doctors and the retraining of all doctors on a regular basis.
D) reviewing the Notice of Privacy Practices for the facility and keeping them up to date.

Question 38

Information access is a required administrative safeguard under HIPAA Security Rule. It is defined as

A) access to the medical record for treatment purposes.
B) limiting access to the minimum necessary for the particular job assigned to the particular login.
C) restricting access to only clinical staff for treatment purposes, medical records department for coding purposes, and the billing department for purposes of claim submission.
D) only allowing patients access to their medical records if it is court ordered.

Question 39

The Administrative Safeguards mandated by HIPAA include which of the following?

A) Unique health plan identifiers
B) Workforce security training
C) Evaluation of computer security effectiveness
D) Sanctions for unauthorized disclosures

Question 40

Audit trails of computer systems include:

A) who logged in, what was done, when it was done, and what equipment was accessed.
B) who logged in, what was changed, and when it was altered.
C) all users' passwords and login information.
D) all security incidents recorded in patient records.

Question 41

Complaints about security breaches may be reported to

A) Centers for Medicare and Medicaid Services.
B) Office of E-Health Standards and Services.
C) Office for Civil Rights.
D) Office of HIPAA Standards.

Question 43

Investigation of complaints of violations to the Security Rule are under the direction of the

A) Department of Justice.
B) Department of Health and Human Services.
C) Office of HIPAA Standards.
D) Office of Inspector General.

Question 44

Use of e-mail for transmitting PHI is

A) permitted only if a security algorithm is in place.
B) permitted without restrictions.
C) excluded from possible use under the Security Rule.
D) allowed only if both sender and receiver(s) agree to keep e-PHI private.

Question 45

HIPAA training must be provided to

A) all clinical staff personnel.
B) only volunteer and nonpaid staff.
C) only new employees.
D) all workforce employees and nonemployees.

Question 46

Whenever a device has become obsolete, the Security Office must

A) check the item off the list of equipment to maintain in the facility.
B) verify that the facility does not need the equipment any more before selling it.
C) log the date of disposal and the amount of its depreciation.
D) record when and how it is disposed and that all data was deleted from the device.

Question 47

The policy of disclosing the "minimum necessary" e-PHI addresses

A) those who bill health claims only.
B) authorizing personnel to view PHI.
C) information sent to a health plan for reimbursement.
D) for all clinical staff when treating a patient.