Registered Health Information Administrator / Technician (RHIA / RHIT) Health Law, Privacy, Security, and Compliance Syllabus

What is the 'minimum necessary' standard under HIPAA?

Covered entities must limit the use, disclosure, and request of PHI to the minimum amount necessary to accomplish the intended purpose; it does not apply to treatment, to the individual, or to disclosures required by law.

For what three purposes (TPO) may PHI be used or disclosed without patient authorization?

Treatment, Payment, and health care Operations.

What is the difference between a use and a disclosure of PHI?

A use is the sharing or handling of PHI within the covered entity; a disclosure is the release or transfer of PHI to an entity outside the covered entity.

Name three disclosures that HIPAA permits without authorization for public interest/benefit.

Examples: required by law, public health activities, reporting abuse/neglect, judicial/administrative proceedings, law enforcement, organ donation, research (with conditions), serious threats to health/safety, and workers' compensation.

What is an accounting of disclosures, and what disclosures are excluded from it?

A patient's right to receive a list of certain PHI disclosures made by a covered entity; excluded are disclosures for treatment, payment, operations, those made to the individual, and those made pursuant to an authorization.

Under HIPAA, what is the time limit (and standard look-back period) for responding to a request for an accounting of disclosures?

A covered entity must act within 60 days (with one 30-day extension), covering disclosures made in the 6 years prior to the request.

List the patient rights granted under the HIPAA Privacy Rule.

Right to notice of privacy practices, right to access/inspect and obtain a copy of PHI, right to request amendment, right to an accounting of disclosures, right to request restrictions, right to request confidential communications, and right to file a complaint.

What is the timeframe for a covered entity to provide an individual access to their PHI?

Within 30 days of the request, with one allowable 30-day extension if the individual is notified in writing of the reason and expected date.

Can a covered entity deny a patient's request to amend their record, and what must it then do?

Yes—e.g., if the information is accurate/complete or not part of the designated record set. It must provide a written denial and allow the patient to submit a statement of disagreement to be included in the record.

What is the Notice of Privacy Practices (NPP)?

A document covered entities must give patients describing how their PHI may be used and disclosed and outlining the patient's privacy rights; providers must make a good-faith effort to obtain written acknowledgment of receipt.

What are the three categories of safeguards required by the HIPAA Security Rule?

Administrative safeguards, physical safeguards, and technical safeguards (to protect the confidentiality, integrity, and availability of ePHI).

Give two examples of administrative safeguards under the HIPAA Security Rule.

Security management process and risk analysis, workforce security and training, assigned security responsibility, contingency planning, and information access management.

Give two examples of physical safeguards under the HIPAA Security Rule.

Facility access controls, workstation use and security policies, and device and media controls (disposal, reuse, backup).

Give two examples of technical safeguards under the HIPAA Security Rule.

Access control (unique user IDs), audit controls, integrity controls, person/entity authentication, and transmission security (encryption).

What is the difference between 'required' and 'addressable' implementation specifications in the HIPAA Security Rule?

Required specifications must be implemented; addressable specifications must be assessed and implemented if reasonable/appropriate—or an equivalent alternative documented if not, but they cannot simply be ignored.

Define confidentiality, integrity, and availability (the CIA triad) for ePHI.

Confidentiality: ePHI is not disclosed to unauthorized persons; Integrity: ePHI is not improperly altered or destroyed; Availability: ePHI is accessible and usable by authorized persons when needed.

What is role-based access control (RBAC)?

An access control method that grants users permission to information based on their job role/function, supporting the minimum necessary standard.

What is risk analysis under the HIPAA Security Rule?

A required, accurate, and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI held by the organization.

In risk management, how is risk commonly expressed in terms of threat, vulnerability, and impact?

Risk = the likelihood that a threat will exploit a vulnerability, combined with the resulting impact/magnitude of harm to ePHI.

What is the difference between a threat and a vulnerability?

A threat is any potential cause of an unwanted incident (e.g., hacker, fire, malware); a vulnerability is a weakness or flaw that a threat can exploit (e.g., unpatched software, no encryption).

Name four common strategies for responding to identified risk in risk management.

Risk mitigation/reduction (apply controls), risk acceptance, risk avoidance, and risk transfer (e.g., insurance).

How does the HITECH Act define a breach of unsecured PHI?

The unauthorized acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy, unless a low probability of compromise is demonstrated by a risk assessment.

What four factors must be assessed to determine the probability that PHI has been compromised in a breach risk assessment?

(1) Nature and extent of the PHI involved, (2) the unauthorized person who used/received it, (3) whether the PHI was actually acquired or viewed, and (4) the extent to which the risk has been mitigated.

Under the Breach Notification Rule, when must affected individuals be notified of a breach?

Without unreasonable delay and no later than 60 days after discovery of the breach.

When must a breach be reported to HHS and the media, based on number of individuals affected?

Breaches affecting 500 or more residents of a state/jurisdiction require notice to HHS and prominent media outlets without unreasonable delay (within 60 days); breaches under 500 are logged and reported to HHS annually.

What are the seven core elements of an effective compliance program per the OIG/Federal Sentencing Guidelines?

(1) Written policies/standards of conduct, (2) a compliance officer/committee, (3) effective training and education, (4) effective lines of communication (e.g., hotline), (5) internal monitoring and auditing, (6) enforcement through well-publicized disciplinary guidelines, and (7) prompt response and corrective action to detected offenses.

What is the difference between fraud and abuse in health care?

Fraud is an intentional deception or misrepresentation to gain an unauthorized benefit (knowingly false claims); abuse involves practices inconsistent with sound fiscal or medical practices that result in unnecessary cost, without the requisite intent of fraud.

What does the federal False Claims Act (FCA) prohibit?

Knowingly submitting, or causing to be submitted, false or fraudulent claims for payment to the federal government (e.g., Medicare/Medicaid); it includes qui tam (whistleblower) provisions and treble damages plus per-claim penalties.

What is the difference between the Anti-Kickback Statute and the Stark Law (physician self-referral)?

The Anti-Kickback Statute is an intent-based criminal law prohibiting remuneration to induce referrals for federally funded items/services; the Stark Law is a strict-liability civil law prohibiting physician referrals for designated health services to entities with which they have a financial relationship.

What is the AHIMA Code of Ethics intended to do for health information professionals?

It establishes the ethical principles and professional values (e.g., protecting confidentiality, ensuring information integrity, refusing to participate in unethical practices) that guide HIM professionals' conduct and decision-making.