Confidentiality & Data Security Flashcards
7 cards from real CTR practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Confidentiality & Data Security flashcards as text
Which federal law specifically establishes the foundation for cancer registry confidentiality protections in relation to public health reporting?
Answer: The Cancer Registries Amendment Act (CCRAA)
The Cancer Registries Amendment Act of 1992 established the National Program of Cancer Registries (NPCR) and includes provisions for the confidentiality of cancer registry data.
A registrar is asked to present aggregate cancer incidence statistics at a public health conference. Which of the following presentations would pose the GREATEST re-identification risk?
Answer: Single-year data for a rare cancer in a small rural county
Small cell sizes for rare cancers in small geographic areas create a high risk of re-identification and should be suppressed or aggregated.
Physical security measures for a cancer registry office should include which of the following?
Answer: Locking workstations when not in use and restricting badge access to the registry area
Locking workstations and controlling physical access to registry areas are essential physical safeguards for protecting PHI.
Under the HIPAA Privacy Rule, which of the following is a required element of a valid authorization for release of cancer registry information?
Answer: An expiration date or expiration event
A valid HIPAA authorization must include an expiration date or event that relates to the individual or the purpose of the use or disclosure.
A state cancer registry is subject to a public records request under the state's open records law. The registry MOST likely:
Answer: Is exempt from disclosure because state cancer registry data is typically protected by state statute
Most states have enacted specific statutes exempting cancer registry data from public records laws to protect patient confidentiality.
When a cancer registrar suspects that a breach of unsecured PHI has occurred, what is the MINIMUM timeframe for notifying affected individuals under the HIPAA Breach Notification Rule?
Answer: Within 60 days of discovery of the breach
Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals without unreasonable delay and no later than 60 days after discovering the breach.
Which activity would be considered a HIPAA-permitted disclosure of cancer registry PHI for public health purposes WITHOUT requiring patient authorization?
Answer: Reporting cases to a state cancer registry as required by state law
HIPAA permits disclosure of PHI to public health authorities, including mandatory reporting to state cancer registries authorized by law, without patient authorization.