CramX Logo
RegisterLog in
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Document preview page 1

HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 1

Document preview content for HCCA - CHPC Study Guide with Answers (300 Solved Questions)

HCCA - CHPC Study Guide with Answers (300 Solved Questions)

HCCA - CHPC Study Guide with Answers provides real-world exam experience to sharpen your test-taking skills.

Michael Davis
Contributor
4.5
151
over 1 year ago
Preview (23 of 76 Pages)
100%
Log in to unlock
Page 1 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 1 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedWhat is the purpose of HIPAA?-ANSWER--• Protect PHI from unauthorized disclosure/use;• Prevent fraud, waste and abuse (via Administrative Simplification);• Make health insurance portable under ERISA;• Move health care onto a nationally standardized electronic billing platformHIPAA resides in which CFR section?-ANSWER--45 CFR sections 164.102 through 164.534What are the subparts of HIPAA part 164?-ANSWER--HIPAA-45 CFR 164, subparts:Subpart A-General rulesSubpart C-SecuritySubpart D-Breach notificationSubpart E-PrivacyHow do you determine if an organization is a "Covered Entity"?-ANSWER--1. compare if theorganization meets one of the 3 types of CE (provider, health plan, clearinghouse)and2. determine if the organization electronically transmits one of the 9 definedtransactions:• Health claims or equivalent encounter information• Health claims attachments• Enrollment and disenrollment in a health plan
Page 2 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 2 preview image
Page 3 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 3 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% Verified• Eligibility for a health plan• Health care payment and remittance advice• Health plan premium payments• First report of injury• Health claim status• Referral certification and authorizationThis Act established in 1974 was created for government agencies placing restrictions on how thegovernment can share the information maintained in Federal systems of records that might infringe onan individual's privacy rights with other individuals and agencies.-ANSWER--The Privacy Act of 1974Which of the following is not considered a HIPAA Entity Designation:1. Affiliated covered entity2. Entity that performs healthcare and non-healthcare component activities including both covered andnon-covered functions3. A group health plan4. Contract arrangement with FEDEX carrier-ANSWER--4. Contract arrangement with FEDEX carrierWhat is Gramm-Leach-Bliley Act (GLBA)?-ANSWER--Gramm-Leach-Bliley Act (GLBA), also known as theFinancial Services Modernization Act of 1999, includes The Financial Privacy Rule and The SafeguardsRule requires all financial institutions to protect customer's personal financial information.What is an OHCA?-ANSWER--OHCA (Organized Health Care Arrangement) it's a clinically integratedcare setting where individuals receive health care from more than one provider.These are joint arrangements/activities and have an Integrated Delivery Systemfor easy exchange of PHIdata. See 45 CFR 160.103. OHCAs can also utilize a joint NPP. See 45 CFR § 164.520(d).
Page 4 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 4 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedACE (Affiliated Covered Entity) do not have an Integrated Delivery System because these are legallyseparate covered entities that are associated in business, or affiliated as a result of some commoncontrol or ownership.Both the OHCA and the ACE would allow sharing of PHI across participating entity lines for treatment,payment, operations purposes (TPO).What's an ACE?-ANSWER--ACE (Affiliated Covered Entity)Legally separate covered entities that share common control/ownership and designate themselves as asingle CE for the purpose of complying with the HIPAA Privacy standards.ACEs do not have an Integrated Delivery System, while OHCA do,and can share a single NPP. See 45 CFR§ 164.520(d)ACE example: a health system composed on several affiliated hospitals.Both the OHCA and the ACE would allow sharing of PHI across participating entity lines for treatment,payment, operations purposes(TPO).What's a Hybrid Entity?-ANSWER--Entity that conducts both covered functions (or healthcare-functions) and non-covered functions (other biz/non-healthcare functions) to elect to be a "hybridentity."For instance, a University System that has aresearch laboratory or academic medical center.The post-secondary functions (non-healthcare components) do NOT need to comply with HIPAA.The research lab/med center functions (healthcare component) needs to comply with HIPAA provisionsto protect the use/disclosure of PHI involved.
Page 5 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 5 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedThe transmission of information between two parties to carry out financial or administrative activitiesrelated to health care is called:-ANSWER--Transaction (healthcare transaction).Few examplesof healthcare transactions:healthcare claims;coordination of benefits;health plan premium payments;remittance advice (or ETF, electronic fund transfer);referral certification and authorizationWhat are examples of a BA?-ANSWER--BA (Business Associate)-performs functions or activities onbehalf of a covered entity that involve access by the business associate to protected health information.Examples:claims processingdata analysisbillingbenefit managementquality assurancequality improvementpractice managementlegalactuarialaccounting
Page 6 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 6 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedTrue or False:Ahospital is not required to have a business associate contract with the specialist to whom it refers apatient and transmits the patient's medical chart for treatment purposes.-ANSWER--TRUERemember, use and disclosure of PHI for purposes of TPO requires no specific authorizationTrue or False:Business Associates After HITECH:HITECH made business associates directly responsible for HIPAA compliance within their individualbusinesses that would not otherwise be subject to HIPAA regulations and penalties-ANSWER--TRUEEven if no written contract exists between the covered entity and a contracted company performingservices related to handling PHI in some form, the company is deemed a business associate by law. Thisdeemed status essentially classifies contracted vendors or individuals as business associates solely bythe natureof the services they provide to a covered entity, regardless of whether they intended to beclassified as business associates or were aware of their status as such. HIPAA and HITECH may holdthese vendors to business associate obligations as long as they act as business associates.Likewise, a subcontractor that creates, receives, maintains, or transmits PHI on behalf of a businessassociate is a business associate. A subcontractor of a subcontractor is a business associate as well, andso on down the line.Ref. 2023 HCCA Complete Healthcare Compliance ManualRef. HITECH Act and OCR's 2013 final ruleTrue or False:
Page 7 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 7 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedUnder HIPAA and HITECH, individuals or entities who have been identified as business associates areobligated to enter into a business associate agreement with their contracted covered entities.-ANSWER--TRUEBusiness associate agreement mandate under the HIPAA Privacy Rule. There are some exceptions such:-for purposes of TPO, including payment for health plan premiums-for determining health plan eligibility and enrollment-when there is no involvement of use/disclosure of PHI (e.g., building maintenance)True or False:Under HIPAA and HITECH, individuals or entities who have been identified as business associates areobligated to enterinto a business associate agreement with their contracted covered entities.-ANSWER--Except for TPO, list two examples where a CE requires an authorization to use/disclose PHI-ANSWER--1.Sales and marketing2. Psychotherapy notesHow do you determineif an entity is subject to HIPAA?-ANSWER--By understanding the applicability(healthcare component), entities that transmit health information and fall under the 3 types of CE(health plans, clearinghouses, and providers)HIPAA provide standards for the access, disclosure, transmission, and retention of PHI, and created anational baseline for health information Privacy and Security. At the state level, they can also develophealth information statutes but only adding higher or more restrictive standards than the Federal HIPAArules. This is referred as:a. HIPAA statusb. HIPAA assurancec. HIPAA preemptiond. HIPAA state law-ANSWER--c. HIPAA preemption
Page 8 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 8 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedWhat is the intent of HIPAA?a. standardize healthcare billing and coding to comply with national accounting principlesb. increase payment from providers given the rising cost of healthcare and fraud violationsc. allow group health plans collect premiums after individual has left ajob/employerd. improve healthcare programs and data flow between providers to data mine for fraudulent behavior-ANSWER--d. improve healthcare programs and data flow between providers to data mine for fraudulentbehaviorThe intent of HIPAA is to improve healthcare programs and the delivery of services through the twolargest health plans in the U.S., This is accomplished by improved data flows that leads to betteroutcomes using national standards formats and specific transactions to increase accuracy and rapid wayto data mine ad detect fraudulent behavior.True or False:A physicianis required to have a business associate contract with a laboratory as a condition ofdisclosing protected health information for the treatment of an individual.-ANSWER--FALSERemember, use and disclosure of PHI for purposes of TPO requires no specificauthorizationTrue or False:A hospital laboratory is not required to have a business associate contract to disclose protected healthinformation to a reference laboratory for treatment of the individual.-ANSWER--TRUERemember, use and disclosure of PHI for purposes of TPO requires no specific authorization
Page 9 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 9 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedTrue or False:Research use/disclosure with individual authorization does not expire or continue until the end of theresearch study-ANSWER--TRUETrue or False:Research use/disclosure with individual authorization may be combined with an authorization for adifferent research activity if research related treatment is conditioned on the provision of one of theauthorizations-ANSWER--TRUETrue or False:Research use/disclosure with individual authorization may be combined with other legal permission orconsent to participate in the research - ANSWER--TRUETrue of False:Is it possible for a facility with multiple provider functions to have certain isolated providers or groupswho are subject to Part 2, while the facility as a whole is not subject to Part 2. For example, a largefacility may have primary care providers and a separate unit that provides SUD services. - ANSWER--TRUEExplanation:The SUD unit is subject to Part 2, but the rest of the facility is not.True or False:An individual provider who works in a general medical facility could also be a Part 2 program IF theprovider's primary function is to provide SUD services. - ANSWER--TRUEExplanation:
Page 10 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 10 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedFor example, a primary care physician who provides medication-assisted treatment would only meet therequirement if providing services to persons with SUD is their primary function. However, If a patientwere to receive both primary care and SUD treatment, the SUD providers are still subject to Part 2 andcould not share information with the patient's primary care provider without consent.True or False:A program or facility that provides both, SUD services and Mental Health Services, and a patient hasbeen admitted to receiving both services, his/her records will be subject to the Part 2 regulations-ANSWER--FALSEExplanation:Mental health information is not subject to the standards in 42 CFR Part 2 and can be shared withoutconsent for treatment purposes, including care coordination, as allowed under HIPAA. More details.Only records or information about patients receiving SUD services will be subject to Part 2 and itsuse/disclosure is more restrictive. However, to allow appropriate mental/behavioral health informationsharing with SUD information, a Qualified Service Organization Agreement (QSOA) would be needed asdefined in 42 CFR 2.11 "Qualified service organization" section.What are the 4 federal regulations and/or government agencies that govern the privacy of individuallyidentifiable info in research-ANSWER--1. HHS-FDA (protections of human subject and IRBs)2. HHS-NIH (certificate of confidentiality)3. HHS-Office of Human Research Protections (Common Rule)4. HHS-OCR-HIPAA Privacy RuleRef. HCCA Privacy Handbook 3rd EdCertificates of Confidentiality (CoC) is a formal confidentiality to protect the privacy of human researchparticipants enrolled in biomedical, behavioral, clinical and other forms of sensitive research. CoC areissued by the NIH or the FDA, and are authorized by law by the P___ H___ S___ Act-ANSWER--PublicHealth Services Act.The Privacy Act of 1974 was created in response to the government creating and using computerdatabases. The Act places restrictions on how government can share the information with other
Page 11 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 11 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% Verifiedindividuals and agencies, and ultimately protect the privacy of individuals that is maintained in Systemsof Records by federal agencies. Before a federal agency begins to collect personal information for asystem of records, an advanced public notice must be published in the Federal Register, which outlinesthe administrative, technical, and physical safeguards for protecting the personally identifiableinformation being collected. This "public notice" is called"-S____ of R_____ N__ (SORN)-ANSWER--system of records notice (SORN)ref. HCCA privacy handbook 3rd ed. "Privacy Act 1974" sectionWhat is a research IRB?1. Institutional Research Board2. A group of executives that review all research activities conducted by the Board of Directors3.A group of individuals that review proposed research to protect the privacy of subjects4. Can make changes to the research or alter its content as they seemed appropriate-ANSWER--3. Agroup of individuals that review proposed research to protect the privacy of subjectsAn individual must authorize these marketing communications before they can occur, except:a. when the communication is not for the purpose of providing treatment adviceb. communication from a health insurer to promote their products/servicesc. communication in training material using their photod. hospital uses its patient list to announce the arrival of a new specialty group in general mailing -ANSWER--Except:d. hospital uses its patient list to announce the arrival of a new specialty groupThis activity does not meet the "marketing" definition, for instance, the disclosure of PHI in this exampleis not for exchange of remuneration, or to encourage use of product, promote services.True or False:
Page 12 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 12 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedIt is important that when contracting with payers or health plans they follow not only the HIPAA securitybut also the privacy rule to protect beneficiaries PHI including use/disclosure during payer's marketingactivities-ANSWER--TRUEWhich of the following requires a Business Associate contract/agreement:a. independent medical transcriptionistb. entities that participate in an OHCA (organized healthcare arrangement)c. when a provider simply accepts a discounted rate to participate in the health plan's networkd. US Postal Services or private carriers-ANSWER--a. independent medical transcriptionistexplanation: this is an outsourced service that handles PHI on behalf of the CE. The transcriptionist isperforming an activity for the CE that contains PHI and a BAA is required to ensure proper use anddisclosure.Is a covered entity required to provide notice to individuals about its disclosures of PHI to a PHA forpublic health purposes? - ANSWER--Yes.This is in the covered entity's Notice of Privacy Practices (NPP).The Privacy Rule requires a covered entity to include in its NPP a description of the purposes, whichwould include public health purposes, for which the covered entity may use or disclose PHI without anindividual's authorization.However, the Privacy Rule does not require a business associate (such as an HIE that is a businessassociate) to provide individuals with a NPP.True of False:OHCAs and ACEs are able to produce a joint Notice of Privacy Practice (NPP) - ANSWER--FALSEExplanation:
Page 13 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 13 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedOHCAs are joint arrangements, have an Integrated Delivery System, and therefore agree to abide by theterms of the notice with respect to PHI created or received by the covered entity as part of itsparticipation in the OHCA.ACEs are legally separate covered entities working together and unable to use a joint NPP and theymight still have separate EHRs, separate HIM/ROI functions, etc. and therefore, the PHI data is notcreate or receive in the same manner.True or False:It is your last day at your pediatric clinical site and you are saying goodbye to all of your favoritepatients. You take a picture on your phone of a few of the patients posing together and later post it toyour private blog as an illustration of your last day. Since your blog is private and can only be accessedby those who know the URL, you are not in violation of HIPAA regulations.-ANSWER--FALSEFill in the blank:In the mid-1990s, OIG began to require providers settling civil health care fraud cases to enter intospecific type ofagreements as a condition for OIG not pursuing exclusion. These agreements arereferred as:-ANSWER--Corporate integrity Agreements (CIA)The foundation for establishing a good relationship with a vendor is the Contract. A contract is anexchange of promise, services for money, with a specific remedy for breach of contract. What are someof the key basic elements to contracts.-ANSWER--Basic key elements to contacts include:I. Agreement (Offer and Acceptance)II. Capacity to contract (ability to perform, ask for proof, bios of staff that will perform the criticalservices)III. Consideration (remuneration must be defined)IV. Legal purpose (legal requirements, defined measures including subcontractors responsibilities)V. Legality of form (use key legal language or clauses, assurances)
Page 14 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 14 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedVI. Intention to create legal relations (statement of parties intent to be "legally bound" to abide tomandates)VII. Consent to contract (required signatures)VIII. Mistakes, undue influence (if things go wrong, list alternative options)True or False:Regarding vendor relations, the privacy professional must ensure that the contract supports the privacyprofile. This includes clearly outlining privacy impacts, clauses, mandates,remedies from the vendor'sservices to ensure expectations are met, even when things go wrong.-ANSWER--TRUEHCCA Privacy Compliance Handbook-Vendor Relations and Privacy SectionA Covered Entity may denied an individual access to their PHI under specific circumstances set forth in45 CFR 164.524 (a)(2), which of the following doesn't fall under those circumstances:a. Request for psychotherapy notesb. if it jeopardizes the health, safety, security, rehab of individual (e.g. inmate's' request, suicidalpatient)c. during the course of research/clinical triald. to request restrictions of their PHI-ANSWER--a. Request for psychotherapy notesUnder the HIPAA Privacy Rule, individual has the right to request a copy, an amendment and restrictionsto their PHI, request confidential communications involving your PHI, and list of disclosures. See 45 CFR§ 164.524 (a)(2)38 U.S.C. 7332 deals with confidentially of patient medical record information related to:a. drug abuse, sexually transmitted diseases, and tuberculosisb. HIV/AIDS status
Page 15 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 15 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% Verifiedc. drug abuse, alcoholism, infection with the HIV virus, and sickle cell anemiad. mental illness, HIV status, drug and alcohol abuse-ANSWER--c. drug abuse, alcoholism, infection withthe HIV virus, and sickle cell anemiaTrue or False:The Minimum Necessary is a key concept under the HIPAA security rule-ANSWER--FALSEIt is a key concept under the PRIVACY Rule.Re: HIPAA AuthorizationIs there any information we can release to a person who is calling on behalf of a patient who is notauthorized in a release form?-ANSWER--Patient must be given an "opportunity to agree or object"keeping in mind:1. you can obtain patient's agreement verbally, over the phone, BUT makes notes in file2. only disclose the Minimum NecessaryRe: HIPAA AuthorizationWhen my patients are being treated for car accident injuries, we often receive requests for PHI fromlawyers. I am not sure if we should provide the information and don't know how to decide whether therequest is legitimate.How do we validate the request is legitimate?-ANSWER--Ensure is a valid HIPAA authorization:MUST have the authorization 6 core elements and 3 key statements as per 45 CFR § 164.508 (c)(1) and(2)
Page 16 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 16 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedRe: HIPAA AuthorizationOne of my long term (dental) patients was recently diagnosed with cancer. His new oncologist'sassistant called to request his PHI from our files. I don't know if the patient knows or has authorized this.Can the request be fulfilled?-ANSWER--YES, no authorization is required for purposes of TPO.But, ensure the request is in writing including:Covered Entity's name;Patient's name;Date of the event/time of treatment; andReason for the request.Re: HIPAA Authorization (suspected domestic violence)I strongly suspect that a patient is a victim of domestic violence, although the patient has not confided inme. The abuse seems to be escalating, judging by the injuries I've seen.May I do anything?-ANSWER--You may, this may be an exception to the HIPAA Privacy Rule.IF you reasonably believe the patient to be a victim of adult abuse, neglect or violence, you may reportto the appropriate government agency.You may also obtain patient's agreement, but not required.ARRA passed in 2009, key items to know:-ANSWER--ARRA-also known as "Obama Stimulus" inresponse to the 2008 recessionARRA mandated government spending, tax cuts, and loan guarantees for financial relief to families.ARRA required hospitals to computerize medical records and modernize HIT systems (HITECH).And breach notification provision implemented under HITECH
Page 17 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 17 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedIIHI-ANSWER--Individually Identifiable Health InformationIt's any part of an individual's health information, includingdemographic information (e.g. address, dateof birth) collected from the individualPHI-ANSWER--Protected Health InformationInfo transmitted by electronic media, maintained in electronic media, or transmitted or maintained inany other form or medium.(PHI excludes IIHI education records covered by FERPA)What is de-identified information?-ANSWER--Removing the HIPAA individual identifiable information.This is accomplish by two methods:Expert Determination: de-identification of PHI by an expert (statistical or scientific principles)Safe Harbor: removing the 18 identifiersWhat is re-identification?-ANSWER--CE may assign a number for re-identification; however, thecreation of the numbering system should not be based on the information and the CE is forbidden fromdisclosing the e-identification scheme.What's the Minimum Necessary?-ANSWER--Use/disclose limited PHI to accomplish the intendedpurpose of the use, disclosure, or request.
Page 18 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 18 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedThe Minimum Necessary DOES NOT apply to?-ANSWER--does not apply to:TPOTo the individual directlyTo the HHS Secretary or required by lawWhen authorization is grantedWhere does Minimum Necessary link to in theSecurity rule?-ANSWER--Role Based Access-can contentfilters be used to support the privacy conceptWho can Deceased Individuals information be released to at anytime?-ANSWER--coroners or medicalexaminers (and Funeral Directors as necessary to carry out their duties with respect to the decedent)Preemption under HIPAA means - ANSWER--Federal law states that it preempts or overrides(supersedes) state law on a particular issue, then federal law is the law that must be followed.In general, HIPAA preempts state law that is "contrary" to the federal rule.In many cases, complying with the stronger standard (more stringent) will allow you to comply with bothstate law and HIPAA.Example 1: if state law gives a provider 10 days to respond to a patient's request for a copy of hismedical records, and HIPAA allows 30 days, you can comply with both state and federal law byresponding within 10 days.Example 2: if state law requires longer period for record keeping than the federal law, then go with thelonger period.Valid Authorization core elements (see 45 CFR § 164.508(c)(1)):-ANSWER--1. meaningful description ofthe information to be disclosed
Page 19 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 19 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% Verified2. name of the individual/person authorized to make the requested disclosure3. name or other identification of the recipient of the information4. description of each purpose of the disclosure5. expiration date for the authorization6. signature and date of the individual or their personal representative (someone authorized to makehealth care decisions on behalf of the individual)Valid Authorization 3 key statements (see 45 CFR § 164.508(c)(2)):-ANSWER--The statements are to beincluded in a valid Authorization:• A statement of the person's right to revoke the authorization, exceptions to this right, and adescription of how to revoke:• A statement that treatment, payment, enrollment or eligibility for benefitsmay NOT be conditionedupon signing the authorization;• A statement regarding the potential that the information disclosed pursuant to the authorization maybe re-disclosed by the recipient and, if so, it may no longer be protected by a federal confidentiality law;Note: the person signing the authorization has the right to (or will receive) a copy of the authorization.Fill in the blanks: The three types of AUTHORIZATION:VALID-must have all the 6 required core elements and 3 statements/noticesD_______-lacks any of the required elements/statements, or expiration date has passed, or revoked,etc.
Page 20 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 20 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedC_______-typically allowed in research studies, this authorization may be combined with anotherwritten permission IF it's for the same research related studies-ANSWER--Defective; CompoundRequest for Restrictions-ANSWER--patient has the right to request restrictions on the U&D ofinformation, even for the TPO exception.Provider must determine if it is reasonable, accommodate request, and abide to agreement.Ref § 164.520-Notice of privacy practices for protected health information.Request for Confidential Communication-ANSWER--Patient may request other communicationchannels not typical for the entity, such as email, or meeting in off-site locations.Which subpart of HIPAA part 164 sets limits on how PHI can be used and shared with others and givespatients rights over their informationa. Part 164 Subpart E (Privacy Rule)b. Part 164 Subpart C (Security Rule)-ANSWER--a. Part 164 Subpart E (Privacy Rule)Subpart C (Security Rule) sets the security standards (administrative, technical, and physical safeguards)to protect the confidentiality, integrity and availability of ePHIWhat is the difference between HIPAA security and privacy?-ANSWER--Security-covers ePHIPrivacy-covers all forms (electronic, oral, written)45 CFR164-Subpart C outlines the three safeguards to ensure the _____, ____, ____ of ePHI that both,CE and BA must implement to ensure compliance and protect against anticipated threats, and/orreasonably anticipated uses/disclosures (incidental/inadvertent/unintentional)-ANSWER--Confidentiality, integrity, availability
Page 21 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 21 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedNote: Accidental - must be reported. An accidental HIPAA violation refers to the unauthorized disclosureof PHI (protected health information) without intent. Despite having safeguards and protectivemeasures in place, there is still a possibility of breaching HIPAA regulations. These types of violationscould include an employee accidentally seeing a different patient's medical records, an email being sentto the wrong person or the loss or theft of a personal device that contains PHI.Research HIPAA Waiver criteria: - ANSWER--Research WaiverIn order for research to be conducted, it must meet a minimum set of waiver criteria elements.Elements that must be met to meet wavier criteria are:1) the use or disclosure for the research involved minimum risk to the patient;2) the research could not be conducted without proper access to the waiver being approved; and3) the research could not be conducted without proper access to the use of the PHI. 45 CFR 164.512(i)(2)What's malicious software? - ANSWER--malware, is software that is used to control or take overapplications, workstations, or servers, damage/disrupt a system.See Security Rule, definitions - 45 CFR 164.304A covered entity may use or disclose PHI for TPO...what does TPO stand for - ANSWER--TreatmentPaymentHealth Care OperationsTrue or False:Payer/health plans are allowed to use/disclose beneficiary's PHI in activities such as legal services,medical review, and fraud and abuse detection - ANSWER--TRUE
Page 22 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 22 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedA provider receives a request from the Social Security Administration for PHI relating to a person'sapplication for benefits. Which of the following is the correct method of release?A. Since it is to a federal agency, an authorization from the patient is not needed, so PHI can be released.B. The providershould review the PHI and make a decision on the minimum necessary and release.C. The provider should notify the patient and obtain a signed authorization prior to release.D. Release the information because the patient signed a consent for treatment.-ANSWER--C. Theprovider should notify the patient and obtain a signed authorization prior to releaseAlso known as the "Stimulus Act" or the "Recovery Act", enacted in 2009; its main purpose was to createjobs and stimulate economic growth; it also included provisions to promote health informationtechnology-ANSWER--American Recovery and Reinvestment Act (ARRA)C.I.A. (HIPAA) stands for? - ANSWER--Confidentiality (not available or disclosed to unauthorized person)Integrity (unaltered or destroys in unauthorized manner))Availability (accessible and usable by authorized person)Comprehensive legislation that ensures access to health coverage for those who change jobs or aretemporarily out of work. It also provides the mechanism for funding the Department of Justice and theFBI for health care fraud investigations-ANSWER--Health Insurance Portability and Accountability(HIPAA)True or False:The HIPAA Privacy and Security rules were promulgated to make health care interstate commerce equal,thus creating a national health care privacy and security baseline or floor-ANSWER--TRUE
Page 23 of 23
HCCA - CHPC Study Guide with Answers (300 Solved Questions) - Page 23 preview imageHCCA-CHPC Study Guide-300Questions AndAnswers100% VerifiedOne of the barriers beforeHIPAA was signed into law was the lack of access and national standards. ThePrivacy and Security provisions were integral elements as many States did not have privacy rights orindividual right of access to healthcare records.Re: HCCA Privacy ComplianceHandbookTrue or False:The Office for Civil Rights (OCR) is the entity that oversees HIPAA, and the agency's goal is to ensure thatpatients' health information is properly protected while allowing for the flow of health informationneeded.OCR also provides excellent guidance on steps to take if an entity experiences a cyberattack.-ANSWER--TRUETrue or False:A cyberattack could result in negative press against the organization and lack of trust from patients. Itcould also result in a privacy breach, which puts patients at risk for identity theft and other fraudulentactivity.-ANSWER--TRUECyberattacks threaten patient privacy, clinical outcomes, financial resources, and the organization'sreputation within the community that it serves.A recent study by the Ponemon Institute and IBM Security found that human error accounted for 95% ofcybersecurity breaches.True or False:If disclosing PHI to legal authorities/government/public official, CE must verify identity, for instanceaskingfor a gov badge/ID, credential, or some proof of gov status, such gov written letterhead, warrant,memorandum, etc.-ANSWER--TRUEComputerized data medical records are destroyed by-ANSWER--Magnetic degaussingCovered entities participating in an Organized Health Care Arrangement are permitted toA. act as a single covered entity
Preview Mode

This document has 76 pages. Sign in to access the full document!

Study Now!

X-Copilot AI
Unlimited Access
Secure Payment
Instant Access
24/7 Support
Document Chat

Document Details

Subject
Health Care Compliance Association