Cengage Chapter 4 Notes: Complete With Solutions
All health care providers must be sure they comply with the Security Ruling in
four core areas. Right Ans - 1) Confidentiality, integrity, and availability of
all e-PHI they create, receive, maintain, or transmit
2) Protecting against anticipated uses or disclosures of electronic information
that are not permitted or required under the Privacy Rule
3) Protecting against any anticipated threats or hazards to the security,
survivability, and integrity of e-PHI
4) Ensuring compliance with the Security Rule by their workforce (Ernst &
Young, 2003)
Requirements are organized into five categories Right Ans - 1)
administrative,
2) physical,
3) technical safeguards,
4) organizational requirements, and
5) policies, procedures, and documentation.
Administrative Safeguards Right Ans - Security management
Assigned security responsibility
Workforce security
Information access
Security awareness and training
Security incidents
Contingency plans
Evaluation of security effectiveness
Business associate contracts
Security Management Right Ans - involves implementing policies and
procedures to prevent, detect, and contain any intrusions of security
Risk analysis asks some important questions like the following Right Ans -
Who is able to view what information?
Are there limits to the amount of information accessed by employees?
Is it kept to the "minimum necessary"?
Is there opportunity for the public or patients to view e-PHI other than their
own?
How could this data be lost?
, What is the impact if the data cannot be recovered?
What if it were sent to the wrong party?
How could it be altered in an unauthorized manner?
Is e-PHI transmitted to or stored upon portable devices?
Data Right Ans - Consists of elements that when rearranged or summarized
into a report became information.
Contingency Plans Right Ans - Critical data analysis, that is, what data is
critical to operations?
A data backup plan
A disaster recovery plan
An emergency mode operation plan
Testing and revision procedures
Physical Safeguards Right Ans - The items required under physical
safeguards for security cover four areas.
Facility access controls: building, computers, and infrastructure closets
Workstation location and access
Workstation (software) security
Device and media controls
Facility Access Controls Right Ans - Disaster recovery, business continuity
Emergency mode operation
A facility security plan
Procedures for verifying access authorizations before any access is permitted
security officer must address issues dealing with the following: Right Ans -
Access control
Audit controls
Integrity (of e-PHI)
Person or entity authentication
Transmission security
All covered entities must keep e-PHI secure to ensure data integrity, yet keep
it available for access by those who treat patients.
a. True b. False Right Ans - True
All health care providers must be sure they comply with the Security Ruling in
four core areas. Right Ans - 1) Confidentiality, integrity, and availability of
all e-PHI they create, receive, maintain, or transmit
2) Protecting against anticipated uses or disclosures of electronic information
that are not permitted or required under the Privacy Rule
3) Protecting against any anticipated threats or hazards to the security,
survivability, and integrity of e-PHI
4) Ensuring compliance with the Security Rule by their workforce (Ernst &
Young, 2003)
Requirements are organized into five categories Right Ans - 1)
administrative,
2) physical,
3) technical safeguards,
4) organizational requirements, and
5) policies, procedures, and documentation.
Administrative Safeguards Right Ans - Security management
Assigned security responsibility
Workforce security
Information access
Security awareness and training
Security incidents
Contingency plans
Evaluation of security effectiveness
Business associate contracts
Security Management Right Ans - involves implementing policies and
procedures to prevent, detect, and contain any intrusions of security
Risk analysis asks some important questions like the following Right Ans -
Who is able to view what information?
Are there limits to the amount of information accessed by employees?
Is it kept to the "minimum necessary"?
Is there opportunity for the public or patients to view e-PHI other than their
own?
How could this data be lost?
, What is the impact if the data cannot be recovered?
What if it were sent to the wrong party?
How could it be altered in an unauthorized manner?
Is e-PHI transmitted to or stored upon portable devices?
Data Right Ans - Consists of elements that when rearranged or summarized
into a report became information.
Contingency Plans Right Ans - Critical data analysis, that is, what data is
critical to operations?
A data backup plan
A disaster recovery plan
An emergency mode operation plan
Testing and revision procedures
Physical Safeguards Right Ans - The items required under physical
safeguards for security cover four areas.
Facility access controls: building, computers, and infrastructure closets
Workstation location and access
Workstation (software) security
Device and media controls
Facility Access Controls Right Ans - Disaster recovery, business continuity
Emergency mode operation
A facility security plan
Procedures for verifying access authorizations before any access is permitted
security officer must address issues dealing with the following: Right Ans -
Access control
Audit controls
Integrity (of e-PHI)
Person or entity authentication
Transmission security
All covered entities must keep e-PHI secure to ensure data integrity, yet keep
it available for access by those who treat patients.
a. True b. False Right Ans - True
