HIPPA Contact Tracing Questions and Answers Graded A+

HIPPA Contact Tracing Questions and Answers Graded A+ Which of the following data storage sites meet the security standards established by HIPAA for safely storing PHI? DropBox How long should your laptop be inactive before it automatically locks itself? All of the above It is permissible to store unencrypted PHI on USB drives, laptops, or tablets if you keep the device in your possession at all times. False .ASU allows unencrypted emails to contain PHI. False HIPAA was first developed to provide guidelines as to how health insurance companies and health care providers could appropriately share patient information and to protect a patient's rights to privacy. What does HIPAA stand for? Health Insurance Portability and Accountability Act What federal offices are responsible for the administration and enforcement of these privacy and security laws? The Department of Health and Human Services and the Office of Civil Rights What are the main purposes of HIPAA? All of the above HIPAA's regulations apply to whom? All of the above Business associates (BAs) must agree to comply with HIPAA Privacy and Security Standards via a written business associate agreement. True Under HIPAA, Business Associates are now held to the same requirements as a Covered Entity for HIPAA Privacy and Security Standards. Business Associates include: All of the above What is Protected Health Information (PHI)? All of the above What does the Minimum Necessary Rule mean? Both A and B In relation to the Minimum Necessary standard and meeting state law disclosure requirements, is the following statement true or false? "Where disclosures are required by Arizona state statutes, the Privacy Rule's minimum necessary standard does not apply, because the law requiring the disclosure will establish the limits on what should be disclosed." True How many "personal identifiers" must be removed from or absent from a client's records in order to consider the information as sufficiently "de-identified"? 18 When is it okay to release protected health information? All of the above The Omnibus Rule of 2013 added new requirements for authorization of the sale of PHI. What is the official definition of the Sale of PHI? Receipt by a Covered Entity or Business Associate of direct or indirect financial or non-financial remuneration in exchange for Protected Health Information (PHI). Under the new authorization requirements, is a patient authorization needed for the sale of PHI when it is disclosed for public health purposes, used for research (non-profit) or when assessing fees to the patient to access their own records? No For how many years must a decedent's PHI be protected? 50 years All of the following are components of a valid patient authorization to disclose PHI except..... Statement informing patients they are prohibited from revoking authorization to disclose PHI Do patients/clients have the right to obtain an accounting of the disclosures of their PHI or to request restrictions of the use/disclosure of their PHI? Yes Covered entities are required to provide a Notice of Privacy Practices to all patients/clients upon their first visit for services. A Notice of Privacy Practices needs to contain what information? All of the above HIPAA Security Standards are intended to: All of the above Is it acceptable to send a document containing PHI via fax if the fax machine utilizes a dedicated analog phone line? Yes, if the recipient's fax number is verified prior to sending. As long as you create a secure password, it is okay to write down your password and leave it under your keyboard. False Is it acceptable to save documents containing PHI on your computer's hard drive as long as you log off of your computer when you are not using it? No It is permissible to allow someone to use your password to access electronic PHI if you are both authorized for the same access. True or False? False It is okay to have web browsers remember your password so that your log-on process is faster. False Each Covered Entity at ASU is required to designate staff members as their HIPAA Privacy Officer and HIPAA Security Officer. True The HIPAA Privacy Officer for each Covered Entity is responsible to designate specific personnel to process all uses and disclosures of PHI. True Any ASU employee who provides management, administrative, financial, legal or operational support to a Covered Entity at ASU must comply with HIPAA. True A HIPAA breach is defined as....... An impermissible use or disclosure under the Privacy Rule that compromises the security or privacy of the protected health information. Is this an accurate statement? "Every unauthorized acquisition, access, use, or disclosure of Protected Health Information (PHI) is presumed to be a breach unless the Covered Entity or Business Associate can demonstrate, based on a risk assessment, a 'low probability' that the PHI has been compromised." True When a Covered Entity or Business Associate needs to complete a risk assessment to determine the extent of a potential breach and the need to report it, what factors must they consider in their risk assessment? All of the above What information must be included in a Breach Notification to individuals who might have been impacted by a potential breach? All of the above