Deck 7: Privacy, Security, Confidentiality, and Legal Issues

Question 1

Emails or faxes that are sent and arrive at the wrong location constitute a privacy

A) code.
B) encryption.
C) breach.
D) error.

Answer 1

breach.

Question 2

Each person who has the ability to access a computer software system, for instance, Prime Suite, is set up within the software and assigned a/an __________________, which is typically based on the person's name.

A) user ID
B) password
C) PIN
D) access code

Answer 2

user ID

Question 3

Which of the following is an independent, nonprofit organization with the mission "To lead healthcare transformation through the effective use of health information technology"?

A) Centers for Medicare and Medicaid Services
B) Healthcare Information and Management Systems Society
C) American Medical Information Association
D) International Federation of Record Organizations

Answer 3

Healthcare Information and Management Systems Society

Question 4

An employee at Memorial Medical Practice released the diagnosis of a patient to the patient's spouse without an authorization. This is known as a/an _________________________.

A) accidental disclosure
B) privacy disclosure
C) breach of confidentiality
D) disclaimer

Question 5

In order for the healthcare facility to know what to do in case of a situation that interrupts access to the EHR, a written ____________________ should be in place.

A) policy
B) disaster recovery plan
C) compliance plan
D) audit trail

Question 6

James Philips has asked that certain personnel within the office be prohibited from seeing his health information. How will this record be flagged in Prime Suite?

A) confidential
B) private
C) restricted access
D) sensitive information

Question 7

You are the office manager of Greensburg Medical Center. You have received a letter from one of your patients, Ida Healthway, asking to know the names of all employees and care providers who have accessed her EHR within the last year, since she believes someone has been spreading information about her in the community. You will provide Ms. Healthway with this information, which is known as

A) a patient list.
B) release logging.
C) accounting of information disclosures.
D) information exchange.

Question 8

When correcting written documentation in a paper record, it is necessary to

A) black out the incorrect information.
B) use red ink to rewrite the incorrect information correctly.
C) cross out the incorrect information with one line, enter the correct information, and date and initial the correction.
D) do nothing, since care may have already been given based on the incorrect information.

Question 9

Keeping health information to oneself is known as protecting

A) security.
B) privacy.
C) confidentiality.
D) secrecy.

Question 10

Which of the following passwords would be considered most secure?

A) record
B) record58
C) Record**58
D) Record58

Question 11

A staff member who monitors existing and new regulations and is the "go-to" person should an incident occur is known as the _____________________.

A) office manager
B) HIM department director
C) managing partner
D) compliance officer

Question 12

Lisa Haver is a patient of Dr. Randolph's. You have just opened today's mail and opened a letter from Ms. Haver's attorney because she is involved in a lawsuit regarding an auto accident. What will you do?

A) look for a signed authorization in the envelope that authorizes the office to release Lisa Haver's records to the attorney
B) print the record from the EHR system and send it to the attorney
C) call the patient
D) Write back to the attorney stating that your office policy prohibits you from sending records to attorneys

Question 13

Blocking access to a facility's computer systems by unauthorized users is accomplished through the use of

A) hack prevention services.
B) special hardware.
C) encryption programs.
D) firewalls.

Question 14

HIPAA defines a patient's name, social security number, employer, or medical record/account numbers that tie information to a particular person as

A) protected health information.
B) privileged health information.
C) private health information.
D) confidential health information.

Question 15

The law that strengthened HIPAA privacy and security regulations was

A) Clinical Laboratory Improvement Amendments (CLIA).
B) Health Information Technology for Economic and Clinical Health Act (HITECH).
C) Meaningful Use (MU).
D) Affordable Care Act (ACA).

Question 16

CPT, which is used to code procedures in an office, is an example of a/an _____________.

A) password
B) accounting of disclosures
C) code set
D) storage method

Question 17

Which of the following is not included in a Notice of Privacy Practices?

A) how a patient's health information may be used
B) the name of the individual to whom a record was released
C) that the patient may request correction or amendment to his or her health record
D) entities to whom a patient's information may be released

Question 18

Some states have a Health Information __________________, funded through the ONC, which allows the sharing of health information for continuity of care purposes.

A) Bank
B) Exchange
C) Listserve
D) Entity

Question 19

How is a correction made to an electronic health record?

A) The incorrect entry is corrected and the original entry is deleted from the database.
B) The incorrect entry is corrected and the original entry is hidden from view but is still retrievable.
C) A second entry is made under the original incorrect entry and both are viewable at the same time.
D) No change is made since care may have already been given based on the incorrect information.

Question 20

Nancy Jackson is the office manager of a medical practice. Each month she reviews a report that shows which staff members viewed, edited, or deleted data on a random selection of patient's records, and whether or not the access or the actions taken were justified. Nancy is performing which function?

A) accounting of disclosures
B) auditing
C) quality review
D) quantitative review

Question 21

Ongoing communication about a particular topic, for instance satisfaction with a medical office, may be posted on a __________, a social media format where an author provides periodic commentary on various issues.

Question 22

Upon request, Greensburg Medical Center provides patients with a report detailing the disclosures made to external agencies as well as all accesses to a patient's EHR internally. What is this process of providing a listing of the information released and to whom it was released known as?

Question 23

Amy Shaw, a new medical assistant who has limited access to the functionality of Prime Suite at this time, is only able to register patients. What term refers to the type of rights that restricts or limits access to an EHR?

Question 24

Dr. Patterson has referred his patient, James Holt, to a dermatologist. James' records were sent electronically to the dermatologist's office. The release of records was done to ensure _______________ of care.

Question 25

A suspicious e-mail was received at Greenway Medical Center and included an attachment. Three of the staff members opened the attachment. Within an hour, there were problems with the computer system throughout the office response time was very slow, there were screens that appeared to be scrambled, and a dialogue (pop-up) box appeared in the middle of the screen that would not close. The office contracts out their information technology (IT) maintenance. After reviewing the situation, the IT consultant informed the office manager that the system was infected by a computer virus because the system was unprotected from outside access. How could the office have avoided such a situation?

Question 26

The right to be left alone, or in healthcare, to undergo care without others infringing on one's personal space is known as what?

Question 27

In addition to the American Health Information Management Association, name another nonprofit organization that promotes the effective use of health information technology.

Question 28

What is the acronym of the name of the private, nonprofit organization that used to certify EHR software?

Question 29

You are the privacy officer at your medical office. What might your duties be?

Question 30

Healthcare providers, clearinghouses, and insurance plans are able to access protected health information (PHI) when needed under HIPAA. These healthcare providers are known as what under HIPAA?

Question 31

The fact that a patient is either admitted to or is undergoing treatment in a facility and that his or her location within the facility is known as what kind of information?

Question 32

To help guard against unauthorized individuals accessing a practice's computer system, a unique access code that is known only to the user is used. What is this unique access code called?

Question 33

What is the process whereby electronic transmission of any health information sent in such a way that it cannot be read without a special code that reads it?

Question 34

Facilities typically have policies prohibiting the downloading of music, pictures, and the like in order to prevent attacks from viruses or ______ that might be carried on downloaded items.

Question 35

Which of the following may result in the need to deploy the disaster recovery plan?

A) A computer hacker has gained access to the database and corrupt files have been found.
B) Joy Smith, an employee in the office, entered data on the wrong patient.
C) The IT manager has read that a computer virus has just hit Europe and is expected to hit the United States by end of week.
D) Dr. Ingram lost his cell phone last week.

Question 36

Data that is timely, consistent, secure, and correct is said to have data __________________.

Question 37

Some offices conduct periodic internal ___________________ on every staff member and care provider for the purpose of determining compliance with data use policies.

Question 38

In order to deter unauthorized access to email, documentation and patient information, data may be ___________________.

Question 39

Explain the concept of minimum necessary information in regard to accessing PHI. Give an example that is different from that given in your text.

Question 40

Records were released to a life insurance company without authorization, and the release was not required by law. This is known as a/an _______________.

Question 41

Explain the concept of an audit trail and give an example of its use.

Question 42

Explain why an incorrect chart entry can't be deleted entirely from the database once it has been corrected.

Question 43

Kate Simpson, an office manager, is able to access all of the functionality of Prime Suite, but Amy Shaw, a medical assistant, is able to access only registration and charting functions. Discuss why their access is different.

Question 44

Explain the topics that should be covered in a disaster recovery plan.

Question 45

Why might a patient want an accounting of disclosures from his/her EHR to employees and care providers within the medical practice or hospital?

Question 46

Why might a hospital or medical office want to have its own blog or other means of social media, such as Facebook?

Question 47

Why would back-up files need to be stored in a location other than the facility?

Question 48

Explain the final rule to HITECH that went into effect in March, 2013.

Question 49

Why is it necessary to have a formal compliance plan?

Question 50

Greensburg Medical Center uses an electronic health record. Anna Oliver, a patient there, has written a letter to the health information manager requesting an accounting of disclosures from her health record during the period of January 1, 2011 through and including June 30, 2011. Is the health information manager able to do this? Explain.

Question 51

If healthcare professionals need the information in a health record to care for a patient, why is it that some staff may be restricted from accessing records at the request of the patient?

Question 52

Why might a hospital or medical office find it necessary to include specific policies regarding the use of social media to communicate about the hospital or office?