HIPAA Compliance Jeopardy

This 1996 federal law's Privacy Rule regulates how covered entities may use and disclose individually identifiable health information.

What is HIPAA?

This office within the Department of Health and Human Services is responsible for enforcing the HIPAA Privacy Rule.

What is the Office for Civil Rights?

This three-part standard permits a provider to use or share health information for a patient's care, billing, and internal business functions without separate authorization each time.

What is treatment, payment, and healthcare operations?

This term describes a health plan, healthcare clearinghouse, or healthcare provider that transmits health information electronically and is directly regulated by HIPAA.

What is a covered entity?

This term describes an outside organization that performs a service involving PHI on behalf of a covered entity, such as billing or IT support, and must sign a written agreement before doing so.

What is a business associate?

This nine-digit government-issued number, used for tax and benefits purposes, is one of the identifiers that turns health data into individually identifiable information.

What is a Social Security number?

This piece of information, recording the day, month, and year a patient was born, is treated as an identifier when it appears alongside health data.

What is a date of birth?

This document, created and maintained by a healthcare provider, chronicles a patient's diagnoses, treatments, and test results over time.

What is a medical record?

This number, printed on a member's insurance card, links health data to a specific enrollee when it appears together with clinical information.

What is a health insurance ID number?

This category of records, documenting the conversations between a therapist and a client, receives extra protection beyond an ordinary medical record.

What are psychotherapy notes?

This companion rule to the Privacy Rule specifically governs how electronic protected health information must be safeguarded.

What is the Security Rule?

This category of Security Rule safeguards includes locked doors, badge access, and facility security plans protecting the spaces where systems are kept.

What are physical safeguards?

This category of Security Rule safeguards includes access controls, audit logs, and encryption that protect data stored in and moving through computer systems.

What are technical safeguards?

This category of Security Rule safeguards includes workforce training, written policies, and risk management that govern how an organization runs its security program.

What are administrative safeguards?

This required process involves identifying potential risks and vulnerabilities to electronic PHI before an organization decides how to address them.

What is a risk analysis?

This right lets a patient obtain a copy of their own medical record from a healthcare provider.

What is the right of access?

This document, handed to patients at a provider's office, explains how their health information may be used and lists their privacy rights.

What is the Notice of Privacy Practices?

This right lets a patient formally ask that incorrect or incomplete information in their medical record be corrected.

What is the right to request amendment?

This right lets a patient obtain a list of certain disclosures a provider has made of their health information over a given period.

What is the right to an accounting of disclosures?

This right lets a patient ask a provider to reach them in a particular way, such as calling only a cell phone rather than a home number.

What is the right to request confidential communications?

This term describes any impermissible use or disclosure of protected health information that compromises its privacy or security.

What is a breach?

This 2009 federal law strengthened HIPAA enforcement and introduced the requirement to notify individuals after a breach.

What is the HITECH Act?

This method scrambles electronic PHI so it becomes unreadable to unauthorized users, and data protected this way is generally exempt from breach notification if it is compromised.

What is encryption?

This term describes unauthorized outsiders breaking into a computer system to steal or expose data, a common cause of large-scale healthcare breaches.

What is a cyberattack?

This general term names the civil financial penalty that regulators may impose on an organization found to have violated HIPAA rules.

What is a civil monetary penalty?

This standard requires covered entities to limit their use, disclosure, and requests of PHI to the smallest amount needed for the intended purpose.

What is the minimum necessary standard?

This exception excuses a provider from the minimum necessary standard when PHI is being used or shared to care for a patient directly.

What is the treatment exception?

This role, required within a covered entity, is typically responsible for developing and implementing the policies that limit staff access to PHI.

What is a privacy official?

This access-control practice limits a computer system so employees can view only the specific patient records relevant to their own job function.

What is role-based access control?

This exception excuses the minimum necessary standard entirely when PHI is disclosed to the very individual who is the subject of the record.

What is disclosure to the individual?