HIO-201 Certified HIPAA Professional Question and Answers

Technology specific

State of the art

Non-Comprehensive

Revolutionary

Scalable

Security Awareness and Training

Security Management Process

Access Control

Assigned Security Responsibility

Security Incident Procedures

Request that the patient sign the lab's Notice of Privacy Practices.

Do nothing more - the activity is covered by the doctor's Notice of Privacy Practices.

Obtain a specific authorization from the patient

Obtain a specific authorization from the doctor.

Verify that the doctor's Notice of Privacy Practices has not expired.

Audit Control

Integrity

Access Control

Person or Entity Authentication

Transmission Security

Situations where the marketing is for a drug or treatment could improve the health of that individual.

Situations where the patient has already signed the covered entity's Notice of Privacy Practices.

A face-to-face encounter with the sales person of a company that provides drug samples

A communication involving a promotional gift of nominal value.

The situation where the patient has signed the Notice of Privacy Practices of the marketer.

Eligibility status

Benefit maximums

Participating providers

Deductibles & exclusions

Co-pay amounts

PKI requirements for hospitals and health care providers.

Encryption algorithms that must be supported by hospitals and health care providers.

Fraud and abuse in the health care system and ways to eliminate the same.

Guaranteed health insurance coverage to workers and their families when they change employers.

The use of strong authentication technology that must be supported by hospitals and health care providers.

Eligibility (270/271).

Premium Payment (820).

Unsolicited Claim Status (277).

Remittance Advice (835).

Functional Acknowledgment (997).

Designate a security officer.

Document termination procedures.

Use biometrics to authenticate transactions.

Deploy tokens and smart cards to all medical personnel.

Verify that business associates treat patient information respectfully.

ICD-9-CM, Volumes 1 and 2

CPT-4

CDT

ICD-9-CM, Volume 3

HCPCS

A covered entity must have and apply sanction against members of its workforce who fail to comply with the privacy policies and procedures of the covered entity)

A covered entity does not need to train all members of its workforce whose functions areaffected by a change in policy or procedure.

A covered entity must designate, and document, a privacy officer, and a HIPAA compliance officer

A covered entity may require individuals to waive their rights.

A covered entity must require the individual to sign the Notice of Privacy Practices prior to delivering any treatment related service.

Sanction Policy

access Authorization

Facility Security Plan

Termination Procedures

Unique User Identification

270

276

278

280

834

No - This would be considered an allowed "routine disclosure" between the doctor and his business partner

Yes - There is no exception to the requirement for an authorization prior to disclosure, no matter how well intentioned or documented.

Yes - a delivery service is not considered a covered entity

Yes - to be a “routine disclosure” all the parties must have their own Privacy Officer as mandated by HIPAA

Yes - this is not considered a part of "treatment", which is one of the valid exceptions to the Privacy Rule

A covered entity must designate, and document, a privacy official, security officer and a HIPAAcompliance officer

A covered entity must designate, and document, the same person to be both privacyofficial and as the contact person responsible for receiving complaints and providing further information about the notice required by the regulations.

A covered entity must implement and maintain written or electronic policies and procedures with respect to PHI that are designed to comply with HIPM standards, implementation specifications and other requirements.

A covered entity must train, and document the training of, at least one member of its workforce on the policies and procedures with regard to PHI as necessary and appropriate for them to carry out their function within the covered entity no later than the privacy rule compliance date

A covered entity must retain the document required by the regulations for a period often years from the time of it's creation or the time it was last in effect, which ever is later.

Title IX: Employer sponsored group health plans.

Title III: Tax-related Health Provisions.

Title II: Administrative Simplification.

Title I: Health Care Insurance Access, Portability, and Renewability.

Title V: Revenue Offsets.

Power Backup plan

Data Backup Plan

Security Testing

Risk Analysis

Authorization and/or Supervision

Security Management Process

Facility Access Control

Security Awareness and Training

Workforce Security

Security Management Process

270.

820

837.

277.

278.

277.

278.

271.

82.

270.

Establishing an orderly hierarchy where HIPAA applies, then other Federal law, then State law.

Defining privacy to be a national interest that is best protected by Federal law

Allowing State privacy laws to provide a cumulative effect lower than HIPAA.

Mandating that Federal laws preempt State laws regarding privacy.

Establishing a "floor" for privacy protection.