Question 1

You have been given the responsibility of deciding which access control to use. Which of the following is one of your options?

Accepted Answer

Biometrics is a strong form of access control as it involves using unique physical characteristics of an individual, such as fingerprints or iris scans, to grant access. This form of access control is difficult to hack or replicate, making it a secure option. Audit trails, authentication, and mitigations are important components of overall security but do not provide the same level of protection as biometrics.

Question 2

You are walking around the facility to identify any privacy and security issues. You walk onto the 6W nursing unit and are able to watch the nurse entering confidential patient information. How can you best improve the privacy of the patient's health information?

Accepted Answer

Turning the computer screen so that the public cannot see it is the best option to improve the privacy of the patient's health information. Asking the nurse to type the data at another computer may not be necessary if the current computer is in a private area. Giving the nurse additional training may not directly address the issue of patient privacy on this particular computer.

Question 3

The surgeon comes out to speak to a patient's family. He tells them that the patient came through the surgery fine. The mass was benign and they could see the patient in an hour. He talks low so that the other people in the waiting room will not hear but someone walked by and heard. This is called a(n)

Accepted Answer

This is an example of an incidental disclosure, where patient information is disclosed unintentionally and without malice. In this case, someone overheard the conversation despite the surgeon attempting to keep it private. It is not a privacy breach because there was no intentional release of information, nor is it a violation of policy unless the hospital has a specific policy relating to speaking with family members in public areas. It is also not a privacy incident as there was no breach of protected health information.

Question 4

Rachel, a nurse, can write progress notes in the patient's electronic health record. Vera, a cod can view the progress notes but is not authorized to write a progress note. What controls this?

Accepted Answer

Based access control determines access to resources based on the user's job duties and responsibilities. In this case, Rachel has access to write progress notes because it is part of her job duties as a nurse. Vera, who is a cod and does not have the job duty of writing progress notes, is not authorized to do so. This is an example of role-based access control, a type of based access control. Authentication, two-factor authentication, and biometrics are all methods of verifying a user's identity, but they do not control what resources they have access to.

Question 5

You are walking around the facility to identify any privacy and security issues. You walk onto the 6W nursing unit and stand in a public area to look for possible violations. From where you are standing, you see that anyone can watch the nurse entering confidential patient information. You make a note of this. What are you doing?

Accepted Answer

The scenario describes conducting a risk assessment to identify a privacy and security issue where confidential patient information is being entered in a public area where anyone can watch. A risk assessment would help to identify the potential risks and vulnerabilities associated with this practice and offer solutions to mitigate them. Conducting a gap analysis and monitoring audit trail are not relevant in this context.

Question 6

Surf Side Hospital has conducted extensive privacy training for their employees. They trust their employees because it is a small community. There have not been any breaches in the past. They feel that monitoring compliance through an audit trail is not necessary. In this circumstance would it be reasonable to forgo keeping an audit trail?

Accepted Answer

Trust and extensive privacy training for employees are important, but they are not sufficient reasons to forgo an audit trail. Employee actions can still cause accidental or intentional breaches, and monitoring compliance through an audit trail helps identify and prevent such incidents. Even in a small community where everyone is known, human error and malicious intent can still occur, making it important to have a record of access and activity.

Question 7

Sarah is the director of HIM at a Brandon Community Hospital. This is a small hospital that does not have an alcohol or drug abuse unit, nor does it treat patients of this type. Last night in the ER a patient came in who was diagnosed with acute alcoholism and was transferred to another facility for treatment. Does Brandon Community Hospital have to follow the regulations on the confidentiality of alcohol and drug abuse patients?

Accepted Answer

According to the regulations on the confidentiality of alcohol and drug abuse patients (42 CFR Part 2), hospitals are only required to follow these regulations if they have a program or staff whose primary function is to provide alcohol or drug abuse diagnosis, treatment or referral for treatment. Since Brandon Community Hospital does not have a unit or staff for this purpose, they are not obligated to follow these regulations.

Question 8

Mark is an HIM employee who utilizes six different information systems as part of his job. Each of these has a different password. In order to keep up with the password for each system, Mark has written them all on paper and taped it to the back of his wife's picture on his desk. What technology could be used to eliminate this problem for Mark and other employees in the same situation?

Accepted Answer

Single Sign-On (SSO) is a technology that enables users to access multiple applications with a single set of login credentials. This eliminates the need for users to remember multiple passwords for different systems, reducing the risk of password-related errors and increasing security. SSO can be implemented with various protocols such as SAML, OAuth, and OpenID Connect.

Question 9

Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be re­created by authorized users. This technique is called

Accepted Answer

Data encryption is the process of transforming original data into a form that is unintelligible to anyone who doesn't have the key to decrypt it. This ensures that confidential information sent over the Internet is secure and cannot be accessed by unauthorized individuals. Firewalls, validity processing, and call-back processes are all security measures, but they do not involve encryption.

Question 10

A patient asked for an amendment to her medical record. The hospital has denied the request. According to HIPAA, this can be done if

Accepted Answer

HIPAA allows patients to request amendments to their medical record, but the request can be denied if the documentation is accurate and complete. Therefore, options A, B, and D are not sufficient reasons to deny the request.

Question 11

Ms. Hall has requested that Dr. Moore amend her medical record. He emphatically refused. What type of documentation is required, if any?

Accepted Answer

Documentation of the request and refusal is necessary to ensure that there is a record of Ms. Hall's request and Dr. Moore's refusal. This can be important for legal and other purposes in the future.

Question 12

Cindy, Tiffany, and LaShaundra are all nurses at Desert Sands Health Care. They all have access to the same functions in the information system. It is likely that this facility is using

Accepted Answer

Role-based access is the best choice for this scenario because all three nurses have access to the same functions in the information system. Role-based access assigns permissions to specific roles within an organization, rather than to individual users. This would be the most efficient way to manage access in a healthcare setting where many employees have similar job duties and require access to the same information. User-based access and discretionary access control (DAC) would be less suitable in this scenario, as they would require more time and resources to manage access for each individual user. Mandatory access control (MAC) may be appropriate in highly secure settings, but is not necessary for this scenario.

Question 13

The HIPAA rule does not require specific technologies to be used but rather provides direction on the outcome. The term used to describe this philosophy is

Accepted Answer

The HIPAA rule is technology neutral, meaning it does not require the use of specific technologies, but rather focuses on the desired outcome. This allows covered entities to use whatever technologies they deem appropriate to comply with the regulations.

Question 14

If HIPAA and state law conflicts, which prevails:

Accepted Answer

When HIPAA and state law conflict, the more protective law should prevail. In most cases, HIPAA provides a baseline of privacy protection, but state laws may offer more stringent protections for patients. Therefore, whichever law provides the highest level of protection for patient privacy should be followed.

Question 15

You are a researcher at the local university hospital. You will need to access patient information without patient authorization to conduct your research. Which of the following statements is true?

Accepted Answer

In order to access patient information without patient authorization, the institutional review board must waive the requirement for patient authorization. This is done to ensure that patient privacy is protected and that the research is conducted ethically. It is not appropriate to access patient information without proper authorization or consent.

Question 16

You will be choosing the type of encryption to be used for the new EHR. What are your choices?

Accepted Answer

A combination of both symmetric and asymmetric encryption is the best choice for EHR. Symmetric encryption is faster and more efficient for encrypting large amounts of data, but it requires a shared secret key between the sender and receiver. Asymmetric encryption is more secure, as it uses a public key for encryption and a private key for decryption, but it is slower and less efficient for encrypting large amounts of data. A combination of both encryption types allows for the most efficient and secure method of protecting EHR data.

Question 17

Which of the following documents is subject to the HIPAA security rule?

Accepted Answer

The HIPAA Security Rule applies to electronic protected health information (ePHI), and a scanned operative report stored on a CD is considered ePHI.

Question 18

Your system just crashed. Fortunately you have established a site that holds computer processors that can be converted to meet our needs quickly. This is a

Accepted Answer

The answer of Your system just crashed. Fortunately you have...

Question 19

The administrator states that he should not have to participate in privacy and security training. How should you respond?

Accepted Answer

All employees, including top administration, need to participate in privacy and security training to ensure compliance and protect sensitive information. The administrator cannot exempt themselves from training.

Question 20

Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely

Accepted Answer

Psychotherapy notes are considered privileged information and are typically not released to the patient unless required by law. Alcohol and drug records, AIDS records, and mental health assessments can be released to the patient with certain limitations and restrictions.

Exam 1: Registered Health Information Administrator

You have been given the responsibility of deciding which access control to use. Which of the following is one of your options?

You are walking around the facility to identify any privacy and security issues. You walk onto the 6W nursing unit and are able to watch the nurse entering confidential patient information. How can you best improve the privacy of the patient's health information?

Rachel, a nurse, can write progress notes in the patient's electronic health record. Vera, a cod can view the progress notes but is not authorized to write a progress note. What controls this?

Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be recreated by authorized users. This technique is called

A patient asked for an amendment to her medical record. The hospital has denied the request. According to HIPAA, this can be done if

Ms. Hall has requested that Dr. Moore amend her medical record. He emphatically refused. What type of documentation is required, if any?

Cindy, Tiffany, and LaShaundra are all nurses at Desert Sands Health Care. They all have access to the same functions in the information system. It is likely that this facility is using

The HIPAA rule does not require specific technologies to be used but rather provides direction on the outcome. The term used to describe this philosophy is

If HIPAA and state law conflicts, which prevails:

You are a researcher at the local university hospital. You will need to access patient information without patient authorization to conduct your research. Which of the following statements is true?

You will be choosing the type of encryption to be used for the new EHR. What are your choices?

Which of the following documents is subject to the HIPAA security rule?

Your system just crashed. Fortunately you have established a site that holds computer processors that can be converted to meet our needs quickly. This is a

The administrator states that he should not have to participate in privacy and security training. How should you respond?

Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely

Exam 1: Registered Health Information Administrator

You have been given the responsibility of deciding which access control to use. Which of the following is one of your options?

You are walking around the facility to identify any privacy and security issues. You walk onto the 6W nursing unit and are able to watch the nurse entering confidential patient information. How can you best improve the privacy of the patient's health information?

Rachel, a nurse, can write progress notes in the patient's electronic health record. Vera, a cod can view the progress notes but is not authorized to write a progress note. What controls this?

Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be re­created by authorized users. This technique is called

A patient asked for an amendment to her medical record. The hospital has denied the request. According to HIPAA, this can be done if

Ms. Hall has requested that Dr. Moore amend her medical record. He emphatically refused. What type of documentation is required, if any?

Cindy, Tiffany, and LaShaundra are all nurses at Desert Sands Health Care. They all have access to the same functions in the information system. It is likely that this facility is using

The HIPAA rule does not require specific technologies to be used but rather provides direction on the outcome. The term used to describe this philosophy is

If HIPAA and state law conflicts, which prevails:

You are a researcher at the local university hospital. You will need to access patient information without patient authorization to conduct your research. Which of the following statements is true?

You will be choosing the type of encryption to be used for the new EHR. What are your choices?

Which of the following documents is subject to the HIPAA security rule?

Your system just crashed. Fortunately you have established a site that holds computer processors that can be converted to meet our needs quickly. This is a

The administrator states that he should not have to participate in privacy and security training. How should you respond?

Ms. Thomas was a patient at your facility. She has been told that there are some records that she cannot have access to. These records are most likely

Your organization is sending confidential patient information across the Internet using technology that will transform the original data into unintelligible code that can be recreated by authorized users. This technique is called