HIPAA

Question 1

Original Goal

Answer 1

to imporve healthcare efficiency

Question 2

Privacy Rule Disclosure Requirements

Answer 2

PHI may not be disclosed except to:
- the patient
- part of treatment/payment/healthcare operations
- under valid auth from patient
- other permitted/required disclosures
* Minimum necessary

Question 3

Security Rule

Answer 3

ONLY APPLIES TO ePHI
- require minimum security standards (Amin/Technical/Physical safeguards)
- “reasonable and appropriate” level of security
- there are both “required” and “addressable” security controls
NIST SP 800- 662R> implement a security plan

Question 4

Privacy Rule Patient Rights Requirements

Answer 4

• Privacy Notices (detailed notice of privacy rights)
• patient access rights (to designated record set)
• right to amend
• right to accounting of disclosures
• accountability requiresments (minimum necessary/disclosure limits)

Question 5

Privacy Rule Safety Requirements

Answer 5

Require minimum security standards (Amin/Technical/Physical safeguards)

Question 6

Enforcement

Answer 6

HHS Office of Civil Rights
- fines up to 2 million /year
- audits of CE/BA

DOJ- criminal prosecution
- prision up to 10 years

FTC- UDAP

State AG

Question 7

HIPAA Safe Harbor Rule

Answer 7

Deidentifying data
- remove 18 idenitifiers
- after those are removed, you must not acutally know any realistic way the remaining data could still be idenitified

• if both are true, data is cconsidered deidentified under Safe Harbor so HIPAA use/disclosure rules no long apply

Question 8

HIPAA HBNR - HHS Secretary

Answer 8

• 500+ = notify promptly
• under 500 =. within 60 days of the end of the calendar year in which the breach occured

Question 9

HIPAA HBNR - Media

Answer 9

• CE must notify prominent media outlets in a state if breach affects more than 500 residents

Question 10

HIPAA HBNR - Substitute Notice

Answer 10

if contact infor for 10+ affected individuals in not available, subsistute notice must be posted on orgs website

Question 11

HIPAA HBNR - Business Associates

Answer 11

• BAs must notifiy CE

Question 12

HIPAA Rulemaking

Answer 12

HHS OCR

Question 13

HIPAA HBNR- Individuals

Answer 13

• must notifiy potentially affected individuals
• “without unreasonable delay” and “within 60 days”