HIPAA Training

Clients, Organization's Staff, Subcontractors, Partners

True

All of the Above

The PHI to be disclosed and the uses that may be made of that information

Business associates are NOT required to obtain "satisfactory assurances" (i.e., that their PHI will be protected as required by HIPAA law) from their subcontractors

All of the Above

Using a firewall to protect against hackers

Compliance Officer: an organization must designate an individual to take responsibility for implementing and overseeing HIPAA privacy compliance at the... Employee Training: An organization must train all of its workforce that have access to PHI on a HIPAA awareness training and at a minimum of 2 years... Formal Documents and Controls: An organization must implement formal documents and controls to protect PHI that the organization has access to or maintains.

Any person or organization that stores, maintains or transmits individually identifiable health information electronically

Healthcare providers, health insurance carriers, employer group health plans, and healthcare clearinghouses

Privacy Standards

Business Associates

Healthcare provider

Internet firewalls to ensure that hackers don't steal patient health information

To protect data and control access to it

Both A & C

Non-routine disclosures

Allow individuals to transfer jobs and not be denied health insurance because of pre-existing conditions

Administrative, Physical, and Technical safeguards

Education

Their corporate status

If they routinely use, create, or distribute protected health information on behalf of a covered entity

Insurance broker

a technology neutral, federally mandated "floor" of protections whose primary objective is to protect the confidentiality, integrity, and availability of individually identifiable health information in electronic form when it is stored, maintained, or transmitted

Security defines safeguards for ePHI versus Privacy which defines safeguards for PHI

Health Insurance Portability and Accountability Act

Notify the Covered Entity

Protected Health Information

Data Encryption

Covered entities and business associates are required to limit the use or disclosure of PHI to the minimum necessary to accomplish the intended or specified purpose

reasonable and scalable to account for the nature of each organization's culture, size, and resources. Each organization will determine its own privacy policies and security practices within the context of the HIPAA requirements and its own capabilities and needs

Department of Health and Human Services

Civil and Criminal

True

disclose protected health information outside of what is specified in the Business Associate Contract and the HIPAA regulations