Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Aspects of Health Law > HIPAA Security Rule > Flashcards

HIPAA Security Rule Flashcards

(57 cards)

Start Studying
1
Q

2 purposes of the Security Rule

A
  1. implement appropriate security safeguards to protect ePHI
  2. Protect an indv health info
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What does the Security Rule protect?

A

electronic PHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Difference between Privacy and Security Rules

A

Privacy: protects PHI regardless of medium

Security: ePHI

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Which office enforces the security rule?

A

Office for Civil Rights of HHS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does it mean to “protect” the data?

A

CEs must ensure integrity and confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is integrity?

A

Lack of alteration of destruction in an unauthorized manner

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a key characteristic of the Security Rule?

A

It must be flexible

(NOTE: small orgs cannot implement the same as large orgs).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Security Rule: Required (R) implementation

A

Must be implemented as laid out

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Security Rule: Addressable (A) implementation

A

Must be implemented as laid out OR in an alternate manner OR documented if not needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Can addressable implementation specifications be ignored?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

5 components of HIPAA Security Rule

A

A. General Requirements
B. Flexibility of Approach
C. Standards
D. Implementation Specifications
E. Maintenance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

HIPAA Security Rule: A- General Requirements (4)

A
  • ensure confidentiality and integrity
  • protect ePHI from threats
  • protect against reasonably anticipated ePHI uses/disclosures
  • ensure workforce compliance
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

HIPAA Security Rule: B- Flexibility of Approach (4)

A
  • CE size and complexity
  • security capabilities
  • cost of security measures
  • risk management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

HIPAA Security Rule: C- Standards Safeguards (5)

A
  1. Administrative
  2. Physical
  3. Technical
  4. Org Requirements
  5. Policies, Procedures and Documentation
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Admin Safeguards (Security management process)

A

Implement procedures to prevent, detect, contain, and correct security violations

Ex:
- Risk analysis (R)
- Risk management (R)
- Sanction policy (R)
- Info system activity review (R)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Admin Safeguards (Security management process) - Sanction Policy

A

(R) Apply sanctions for non-compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Admin Safeguards (Security management process) - Info System Activity Review

A

(R) regular procedures to review system activity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Admin Safeguards (Assigned Security Responsibility)

A

(R) identifying security official to develop and implement security policies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Admin Safeguards (Workforce Security)

A

Policies to ensure appropriate access to ePHI

Ex:
- Authorization/Supervision (A)
- Clearance procedures (A)
- Termination procedures (A)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Administrative Safeguards: Info Access Management

A

Procedures authorizing access to ePHI

ex:
- Isolate clearinghouse functions (R)
- access authorization (A)
- access establishments & modifications (A)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Administrative Safeguards: Security Awareness Training

A

Implementing a security and awareness training program for workforce members

Ex:
- security reminders (A)
- login monitoring (A)
- Password management (A)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Administrative Safeguards: Security Incident Reporting

A

policies to address security incidents

Ex:
- Response & reporting (R)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Administrative Safeguards: Contingency Plan

Study These Flashcards
A

Policies for responding to an emergency or other occurrence that may damage ePHI

Ex:
- Data backup plan (R)
- Disaster recovery (R)
- Emergency mode operation (R)
- Testing & revision procedures (A)
- Application and data criticality analysis (A)

24
Q

Administrative Safeguards: Evaluation

Study These Flashcards
A

Performing periodic technical and non-technical evaluations (R)

25
Administrative Safeguards: BA Contracts & Other Arrangements
CEs permit BAs to deal with ePHI on their behalf in a written contract
26
Three instances where BA cannot transmit ePHI
1. transmission to provider for treatment 2. transmission to a health plan 3. transmission when CE is a gov health plan providing public benefits
27
4 categories of physical safeguards
1. Facility Access Controls 2. Workstation Use 3. Workstation Security 4. Device and Media Controls
28
Physical Safeguards: Facility Access Controls
Limiting physical access to e-info and facilities where they are housed Ex: - Contingency Operations (A) - Facility Security Plan (A) - Access Control and Validation Procedures (A) - Maintenance Records (A)
29
Physical Safeguards: Workstation Use
Policies that specify the proper work functions (R)
30
Physical Safeguards: Workstation Security
Physical safeguards for workstations that access ePHI (R)
31
Physical Safeguards: Device and Media Controls
Policies that govern the receipt/removal of hardware and e-media containing ePHI Ex: - Disposal (R) - Media Re-Use (R) - Accountability (A) - Data Backup and Storage (A)
32
5 categories of Technical Safeguards
1. Access Control 2. Audit Controls 3. Integrity 4. Person or Entity Authentication 5. Transmission Security
33
Technical Safeguards: Access Control
Implementing measures so ePHI is only accessed by those with access Ex: - Unique User Identification (R) - Emergency Access Procedures (R) - Automatic Logoff (A) - Encryption and Decryption (A)
34
Technical Safeguards: Audit Controls
Measures that record/examine activity
35
Technical Safeguards: Integrity
Measures that protect ePHI from improper alteration or destruction Ex: - Mechanism to authenticate ePHI (A)
36
Technical Safeguards: Person or Entity Authentication
Measures to validate person/vendor seeking access (R)
37
Technical Safeguards: Transmission Security
Measures to guard against unauthorized access to ePHI transmitted over electronic communication network Ex: - Integrity controls (A) - Encryption (A)
38
Two Categories of Organizational Requirements
1. BA Contracts or other arrangements 2. Group Health Plans
39
Organizational Requirements: BA Contracts or other arrangements Must Have.... (3)
- BA compliance - subcontractors compliance - reporting to CE of security incidents
40
Organizational Requirements: Group Health Plans
Requires plan sponsor to reasonably and appropriately safeguard ePHI Ex: - Plan Document (R)
41
Can policies and procedures be changed?
Yes, as long as the changes are documented
42
HHS Recommended Implementation Steps
1. Assess current security and risks/gaps 2. Develop a plan 3. Implement solutions 4. Document decisions
43
HIPAA Security Rule: Security Officer Designation
Individual assigned to be responsible for overseeing the information security program
44
HIPAA Security Rule: Part (e) - Maintenance
a continuing review of the reasonableness and appropriateness of a CE's or BA’s (or subcontractor’s) security measures
45
Patient Matching Errors
info is mismatched or not included in a pt's record
46
Types of Security Threats (3)
- Human (internal vs external) - Natural - Environmental (internal vs external)
47
Examples of internal threats (2)
- lack of MFA - victims of phishing
48
Examples of external threats (1)
- identity theft
49
Types of Medical Identity Theft (2)
1. use w/out consent to obtain medical services 2. Use to obtain money by falsifying claims
50
HITECH Act and Medical ID Theft Red Flags
Red flags to capture medical identity theft
51
Common Security Mechanisms (4)
- biometric identification - automatic log off - termination access - audit trail
52
Firewall protection
A hardware or software that examines traffic entering and leaving a network
53
Viruses: File Infectors
Attach to program files
54
Viruses: System or Boot-Record Infectors
Infect areas of hard disks or diskettes
55
Viruses: Macro Viruses
Infects Microsoft Word application, inserting unwanted words or phrases
56
Viruses: Worm
Stores and replicates itself
57
Viruses: Trojan Horse
Destructive programming code that hides itself in another piece of programming code

Aspects of Health Law (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions