Regulatory Compliance Flashcards
7 cards from real CSP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Regulatory Compliance flashcards as text
Under the HIPAA Breach Notification Rule, a breach affecting more than 500 residents of one state requires notifying which party in addition to the individuals and HHS?
Answer: Prominent media outlets serving that state
Breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets in that area.
What is the outside deadline for notifying affected individuals of a breach of unsecured PHI under HIPAA?
Answer: No later than 60 calendar days after discovery
Notice must be given without unreasonable delay and no later than 60 calendar days after discovery of the breach.
A specialty pharmacy contracts with an outside vendor to run its patient refill-reminder calls using PHI. What document is required under HIPAA?
Answer: Business Associate Agreement
A vendor that creates, receives, or transmits PHI on behalf of a covered entity is a business associate and requires a BAA.
Which federal regulation adds confidentiality protections beyond HIPAA for records from federally assisted substance use disorder treatment programs?
Answer: 42 CFR Part 2
42 CFR Part 2 restricts disclosure of SUD treatment records from federally assisted programs, which is stricter than HIPAA.
Under HIPAA, within how many days must a covered entity generally act on a patient's request to access their PHI?
Answer: 30 days, with one 30-day extension allowed
The Privacy Rule requires action within 30 days, with one 30-day extension if the individual is notified in writing.
The HIPAA minimum necessary standard does NOT apply to which disclosure?
Answer: PHI disclosed to a treating provider for treatment
Disclosures to or requests by a health care provider for treatment purposes are exempt from the minimum necessary standard.
Under the HIPAA Safe Harbor method, how is PHI de-identified?
Answer: Removing the 18 specified identifiers with no actual knowledge that the rest could identify the person
Safe Harbor requires removing 18 listed identifiers, with no actual knowledge that the remaining data could identify the individual.