RHIA Domain 2
Provides entities with structural framework to build a HIPAA security plan -
✔️✔️Security Risk Analysis
Facility Directory - ✔️✔️General Condition
Acknowledgement of admission
If privacy issues emerge... - ✔️✔️Determine source of problem and issue HIPAA
training
If patient is unable to sign... - ✔️✔️Implied Consent
Psychiatric patients may view records if physician determines... - ✔️✔️Seeing record is
not harmful to their condition or treatment
HIPAA's Expert Determination and Safe Harbor - ✔️✔️Deidentification
Log-in with standard ID and password - ✔️✔️Access Control Standard
Legal Hold - ✔️✔️Special tracking of patient records involved in litigation to ensure no
changes are made
Security Risk Analysis First Consideration - ✔️✔️Consider entity's characteristics and
environment
Audit Trail - ✔️✔️Reconstructing electronic events
Entity Authentication - ✔️✔️Reads pre-determined criteria to ensure a user is who they
claim to be
Password systems
Legal Health Record - ✔️✔️Formal business record to be utilized during legal
procedings
Inherent Weakness of a Safeguard - ✔️✔️Vulnerability
Informed Consent - ✔️✔️Risks and benefits of procedure
Alternatives
Description of procedure
, Done by phyisician
Ensuring employees understand security measures - ✔️✔️Workforce Security
Awareness Training
Pre-Employment Physicals - ✔️✔️Not protected by HIPAA bc part of personnel record
HIPAA identifier that has not been implemented - ✔️✔️Individual
Preventing theft of PHI - ✔️✔️Facility Access Controls
Improved security of EHR - ✔️✔️Access Controls
Audit Trails
Authentication Systems
Designated Record Set - ✔️✔️Includes records from other hospitals that were involved
in episode of care decisions
HIPAA Record Retention - ✔️✔️6 years
Rendering PHI unreadable and unusable to unauthorized individuals - ✔️✔️Encryption
and Destruction
Goal of HIPAA Administrative Simplification - ✔️✔️Standardizing electronic
transmission of health data
Technology policies, protocols, and access controls - ✔️✔️Technical Safeguards
Patient Accounting of Disclosures - ✔️✔️Must include disclosure requires patient
authorization
HIPAA Training - ✔️✔️Privacy and security training should not be seperated
Darling vs. Charleston Community Memorial Hospital - ✔️✔️Hospital is responsible for
the quality of care given by its physicians
Not a Business Associate Under HITECH - ✔️✔️Housekeeping
Fundraising solicitations may not - ✔️✔️Target a specific group or diagnosis
Most Constant Threat to Health Information Integrity - ✔️✔️Humans
Provides entities with structural framework to build a HIPAA security plan -
✔️✔️Security Risk Analysis
Facility Directory - ✔️✔️General Condition
Acknowledgement of admission
If privacy issues emerge... - ✔️✔️Determine source of problem and issue HIPAA
training
If patient is unable to sign... - ✔️✔️Implied Consent
Psychiatric patients may view records if physician determines... - ✔️✔️Seeing record is
not harmful to their condition or treatment
HIPAA's Expert Determination and Safe Harbor - ✔️✔️Deidentification
Log-in with standard ID and password - ✔️✔️Access Control Standard
Legal Hold - ✔️✔️Special tracking of patient records involved in litigation to ensure no
changes are made
Security Risk Analysis First Consideration - ✔️✔️Consider entity's characteristics and
environment
Audit Trail - ✔️✔️Reconstructing electronic events
Entity Authentication - ✔️✔️Reads pre-determined criteria to ensure a user is who they
claim to be
Password systems
Legal Health Record - ✔️✔️Formal business record to be utilized during legal
procedings
Inherent Weakness of a Safeguard - ✔️✔️Vulnerability
Informed Consent - ✔️✔️Risks and benefits of procedure
Alternatives
Description of procedure
, Done by phyisician
Ensuring employees understand security measures - ✔️✔️Workforce Security
Awareness Training
Pre-Employment Physicals - ✔️✔️Not protected by HIPAA bc part of personnel record
HIPAA identifier that has not been implemented - ✔️✔️Individual
Preventing theft of PHI - ✔️✔️Facility Access Controls
Improved security of EHR - ✔️✔️Access Controls
Audit Trails
Authentication Systems
Designated Record Set - ✔️✔️Includes records from other hospitals that were involved
in episode of care decisions
HIPAA Record Retention - ✔️✔️6 years
Rendering PHI unreadable and unusable to unauthorized individuals - ✔️✔️Encryption
and Destruction
Goal of HIPAA Administrative Simplification - ✔️✔️Standardizing electronic
transmission of health data
Technology policies, protocols, and access controls - ✔️✔️Technical Safeguards
Patient Accounting of Disclosures - ✔️✔️Must include disclosure requires patient
authorization
HIPAA Training - ✔️✔️Privacy and security training should not be seperated
Darling vs. Charleston Community Memorial Hospital - ✔️✔️Hospital is responsible for
the quality of care given by its physicians
Not a Business Associate Under HITECH - ✔️✔️Housekeeping
Fundraising solicitations may not - ✔️✔️Target a specific group or diagnosis
Most Constant Threat to Health Information Integrity - ✔️✔️Humans
