WGU D220 WEEK 3: Domain 6 Confidentiality Quiz
All of these details must be included in the documentation of record destruction
EXCEPT
A. statement that records were destroyed in the normal course of business
B. dates the patient had surgery
C. method of destruction
D. signature of the individuals supervising and witnessing the destruction *** Record
destruction documentation should include the dates of service of the records that are
being destroyed, but not specific dates of service. Documentation of record destruction
should also include: a statement that records were destroyed in the normal course of
business; the method of destruction; and signatures of the individuals supervising and
witnessing the destruction.
All of these are acceptable destruction methods when health records are no longer
required, EXCEPT
A. burning, shredding, or pulverizing of paper records.
B. shredding or cutting of DVDs.
C. magnetic degaussing for computerized data.
D. deleting files from the server. *** Simply deleting files from a computer or server
does not sufficiently destroy them. In the absence of any state law to the contrary,
medical offices must ensure paper and electronic records are destroyed by a method
that provides for no possibility that the protected health information can be
reconstructed. A common destruction method is magnetic degaussing for computerized
data.
According to the HIPAA Privacy Rule, which of the following would be considered a
covered entity?
A. Department of Health and Human Services
B. Joint Commission
C. Health plans
D. Office of Inspector General *** HIPAA rules define a covered entity as (1) health
plans, (2) healthcare clearinghouses, and (3) healthcare providers who electronically
transmit any health information in connection with transactions for which HHS has
adopted standards.
Department of Health and Human Services was created to protect the health of all
Americans and providing essential human services.
Joint Commission evaluates healthcare organizations and inspiring them to excel in
providing safe and effective care of the highest quality and value.
Office of Inspector General is to detect and deter fraud, waste, and abuse.
The standard that requires all HIPAA covered entities and business associates to
restrict the uses and disclosures of protected health information (PHI) is called
A. minimum Necessary.
B. No disclosure is permitted.
C. PFSH.
, D. patient consent. *** The HIPAA "Minimum Necessary" standard requires all HIPAA
covered entities and business associates to restrict the uses and disclosures of
protected health information (PHI) to the minimum amount necessary to achieve the
purpose for which it is being used, requested, or disclosed.
Patient consent—The process of informed consent occurs when communication
between a patient and physician results in the patient's authorization or agreement to
undergo a specific medical intervention.
The Past, Family and/or Social History (PFSH) includes a review in three areas: Past
History: The patient's past illnesses, operations, injuries, medications, allergies, and/or
treatments
The expert determination method is a method of
A. disclosure.
B. criticality assessment.
C. emergency mode operation plan.
D. de-identification. *** The expert determination method is one method that can be
used to deidentify protected health information. It removes all identifiers so that the
patient cannot be identified. The criticality assessment is determining how important an
information system is. The information systems that are the most critical are given
priority if multiple information systems are down. Disclosure is providing health
information outside of the healthcare organization. The emergency mode operation plan
is the process that allows a user to gain access to health information in an emergency.
De-identification is removing all identifying data elements from the health record.
A document requirement of health organizations pursuant to HIPAA legislation, that
informs patient how a covered entity intends to use and disclose protected health
information is called
A. periodic performance review (PPR).
B. Notice of Privacy Practices (NPP).
C. incident report.
D. informed consent. *** Notice of Privacy Practices is a requirement of HIPAA's
Privacy Rule. None of the other documents are related to HIPAA.
This is an example of an administrative safeguard.
A. Locking offices and file cabinets containing PHI.
B. Shredding unneeded documents containing PHI.
C. Minimizing the amount of PHI on desktops.
D. Implement policies and procedures to prevent, detect, and correct security violations.
*** Administrative safeguards are administrative actions, and policies and procedures,
to manage the selection, development, implementation, and maintenance of security
measures to protect electronic protected health information and to manage the conduct
of the covered entity's workforce in relation to the protection of that information.
Locking offices and file cabinets, minimizing the amount of PHI on desktops, and
shredding unneeded documents are physical safeguards.
All of these details must be included in the documentation of record destruction
EXCEPT
A. statement that records were destroyed in the normal course of business
B. dates the patient had surgery
C. method of destruction
D. signature of the individuals supervising and witnessing the destruction *** Record
destruction documentation should include the dates of service of the records that are
being destroyed, but not specific dates of service. Documentation of record destruction
should also include: a statement that records were destroyed in the normal course of
business; the method of destruction; and signatures of the individuals supervising and
witnessing the destruction.
All of these are acceptable destruction methods when health records are no longer
required, EXCEPT
A. burning, shredding, or pulverizing of paper records.
B. shredding or cutting of DVDs.
C. magnetic degaussing for computerized data.
D. deleting files from the server. *** Simply deleting files from a computer or server
does not sufficiently destroy them. In the absence of any state law to the contrary,
medical offices must ensure paper and electronic records are destroyed by a method
that provides for no possibility that the protected health information can be
reconstructed. A common destruction method is magnetic degaussing for computerized
data.
According to the HIPAA Privacy Rule, which of the following would be considered a
covered entity?
A. Department of Health and Human Services
B. Joint Commission
C. Health plans
D. Office of Inspector General *** HIPAA rules define a covered entity as (1) health
plans, (2) healthcare clearinghouses, and (3) healthcare providers who electronically
transmit any health information in connection with transactions for which HHS has
adopted standards.
Department of Health and Human Services was created to protect the health of all
Americans and providing essential human services.
Joint Commission evaluates healthcare organizations and inspiring them to excel in
providing safe and effective care of the highest quality and value.
Office of Inspector General is to detect and deter fraud, waste, and abuse.
The standard that requires all HIPAA covered entities and business associates to
restrict the uses and disclosures of protected health information (PHI) is called
A. minimum Necessary.
B. No disclosure is permitted.
C. PFSH.
, D. patient consent. *** The HIPAA "Minimum Necessary" standard requires all HIPAA
covered entities and business associates to restrict the uses and disclosures of
protected health information (PHI) to the minimum amount necessary to achieve the
purpose for which it is being used, requested, or disclosed.
Patient consent—The process of informed consent occurs when communication
between a patient and physician results in the patient's authorization or agreement to
undergo a specific medical intervention.
The Past, Family and/or Social History (PFSH) includes a review in three areas: Past
History: The patient's past illnesses, operations, injuries, medications, allergies, and/or
treatments
The expert determination method is a method of
A. disclosure.
B. criticality assessment.
C. emergency mode operation plan.
D. de-identification. *** The expert determination method is one method that can be
used to deidentify protected health information. It removes all identifiers so that the
patient cannot be identified. The criticality assessment is determining how important an
information system is. The information systems that are the most critical are given
priority if multiple information systems are down. Disclosure is providing health
information outside of the healthcare organization. The emergency mode operation plan
is the process that allows a user to gain access to health information in an emergency.
De-identification is removing all identifying data elements from the health record.
A document requirement of health organizations pursuant to HIPAA legislation, that
informs patient how a covered entity intends to use and disclose protected health
information is called
A. periodic performance review (PPR).
B. Notice of Privacy Practices (NPP).
C. incident report.
D. informed consent. *** Notice of Privacy Practices is a requirement of HIPAA's
Privacy Rule. None of the other documents are related to HIPAA.
This is an example of an administrative safeguard.
A. Locking offices and file cabinets containing PHI.
B. Shredding unneeded documents containing PHI.
C. Minimizing the amount of PHI on desktops.
D. Implement policies and procedures to prevent, detect, and correct security violations.
*** Administrative safeguards are administrative actions, and policies and procedures,
to manage the selection, development, implementation, and maintenance of security
measures to protect electronic protected health information and to manage the conduct
of the covered entity's workforce in relation to the protection of that information.
Locking offices and file cabinets, minimizing the amount of PHI on desktops, and
shredding unneeded documents are physical safeguards.
