HITT 1301 Exam 2 Study Guide Flashcards

Vocabulary flashcards covering key definitions, legal regulations, compliance concepts, and chapter topics from the HITT 1301 Exam 2 Study Guide.

A quantifiable measure used over time to determine whether some structure, process, or outcome in the provision of care to a patient supports high-quality performance measured against best practice criteria.

Key indicator

Identifying the objective of the audit before an audit can be conducted.

First step in audit preparation

An approach that focuses on working with individuals to find a mutually acceptable solution.

Conflict management

A set of principles adopted by an organization to guide members in determining right and wrong conduct when performing the duties of their job.

Professional code of ethics

A law that prohibits a physician from referring patients to a business in which he or she or a member of the physician's immediate family has financial interests.

Stark Law

A cost-sharing measure in which the policy holder pays a fixed dollar amount per service.

Copayment

A healthcare provider, health plan, or healthcare clearinghouse that electronically transmits health information in connection with certain standard transactions.

Covered entity under the HIPAA Privacy Rule

Covered entity legal responsibilities

The legal obligation under HIPAA to protect patient privacy, afford patients specific rights over their health information, and adhere to privacy rules when using, disclosing, storing, or sharing PHI.

What is a primary data source in the health record?

Original information documented during patient care, such as clinician notes, test results, and observations.

Information derived from primary records and reused for purposes such as research, quality improvement, reimbursement, or reporting.

What is secondary data?

Primary data documents original patient care; secondary data is extracted or compiled from primary information for another purpose.

How do primary and secondary data differ?

An organized system that collects standardized data about patients with a particular disease, condition, procedure, or other defined characteristic.

What is a healthcare registry?

A listing of patients organized by diagnosis or disease code, used to locate records and analyze disease patterns.

What is a disease index?

A registry collects detailed information on a defined population, often across time; a disease index helps locate records by diagnosis.

How is a registry different from a disease index?

A historical federal data bank that collected reports of certain healthcare fraud, abuse, and adverse actions; its reporting functions were consolidated into the National Practitioner Data Bank in 2013.

What is the Healthcare Integrity and Protection Data Bank?

Agency for Healthcare Research and Quality.

What does AHRQ stand for?

A federal agency that supports research and tools to improve healthcare quality, safety, accessibility, and effectiveness.

What is the role of AHRQ?

HHS, CMS, CDC, FDA, AHRQ, and NIH.

Name examples of federal agencies involved in healthcare.

What is health information exchange?

The secure electronic sharing of health information among authorized organizations to support coordinated care.

Why is HIE useful?

It helps clinicians access relevant information across settings, reducing duplicated testing and improving care coordination.

How is healthcare data used beyond direct patient care?

For quality measurement, public health reporting, research, planning, reimbursement, and performance improvement.

They improve consistency, comparability, accuracy, and usefulness of healthcare information.

Why are standardized data collection and reporting important?

Measures and information used to assess patient outcomes, safety, processes, and quality of care.

What are healthcare quality data?

It is the supreme law of the United States and establishes the framework of government and fundamental legal protections.

What is the role of the U.S. Constitution?

Written laws enacted by a legislative body, such as Congress or a state legislature.

What are statutes?

The party who brings a civil lawsuit.

Who is the plaintiff?

The party against whom a lawsuit is brought.

Who is the defendant?

The plaintiff files the lawsuit; the defendant responds to the claim.

Plaintiff vs. defendant: what is the difference?

A civil wrong resulting from an intentional act, such as assault, battery, or false imprisonment.

What is an intentional tort?

The healthcare facility or organization that maintains the record.

Who generally owns the physical health record?

Why do state record-retention requirements matter?

State requirements establish minimum periods for retaining health records, helping healthcare organizations maintain legal compliance and preserve records for future use.

What determines how long diagnostic images such as x-rays must be retained?

Applicable state and federal laws, regulations, and retention requirements, which may vary by image type and patient age.

Retain it permanently

What does AHIMA recommend for retaining a master patient index?

10 years after the most recent encounter

What is the commonly cited AHIMA recommendation for adult health record retention?

A patient’s voluntary agreement or permission for treatment or another specified activity

What is patient consent?

What is licensure?

A government-issued authorization allowing a qualified professional or facility to practice or operate.

Authorization granted by a healthcare organization allowing a provider to perform specific patient care services or procedures.

What are clinical privileges?

Licensure comes from a government authority; clinical privileges are granted by an individual healthcare organization.

Licensure vs. clinical privileges: what is the difference?

What is The Joint Commission?

An independent nonprofit organization that accredits and certifies healthcare organizations and programs to promote quality and patient safety.

It supports continuity of care, legal compliance, audits, patient access, and organizational accountability.

Why is record retention important in HIM?

A health plan, healthcare clearinghouse, or healthcare provider that electronically transmits health information in covered standard transactions.

What is a HIPAA covered entity?

To establish national protections for individually identifiable health information and regulate permitted uses and disclosures.

What is the purpose of the HIPAA Privacy Rule?

Individually identifiable health information held or transmitted by a covered entity or business associate, subject to HIPAA exclusions.

What is protected health information?

A notice explaining how an organization may use or disclose PHI, patients’ privacy rights, and the organization’s privacy duties.

What is a Notice of Privacy Practices?

PHI not rendered unreadable, unusable, or indecipherable to unauthorized people through approved methods such as appropriate encryption or destruction.

What is unsecured PHI?

Secured PHI has been protected using approved methods; unsecured PHI lacks those protections.

How does secured PHI differ from unsecured PHI?

Required notification after a breach of unsecured PHI, subject to the breach assessment and applicable reporting rules.

What is HIPAA breach notification?

Affected individuals, HHS, and sometimes the media; timing and requirements depend on the circumstances.

Who may need to be notified after a reportable HIPAA breach?

Requirements such as designating a privacy official, training the workforce, establishing safeguards, complaint processes, sanctions, and documentation.

What are HIPAA administrative requirements under the Privacy Rule?

What are core elements of a valid HIPAA authorization?

Description of information, who may disclose it, who may receive it, purpose, expiration date or event, and signature/date, plus required statements about revocation and other rights.

Access and obtain copies of PHI, request amendments, receive an accounting of certain disclosures, request restrictions, request confidential communications, and receive a privacy notice.

Name important patient rights under HIPAA.

Consent vs. authorization under HIPAA: what is the difference?

Consent may permit routine treatment, payment, and operations uses; authorization is a detailed permission required for certain other uses or disclosures.

For treatment, payment, and healthcare operations, and for certain other uses permitted or required by HIPAA.

When may PHI generally be used or disclosed without patient authorization?

The Privacy Rule governs uses, disclosures, and rights involving PHI in all forms; the Security Rule sets safeguards for electronic PHI.

HIPAA Privacy Rule vs. Security Rule: what is the difference?

National requirements for privacy, security, electronic transactions, code sets, and identifiers, depending on the specific HIPAA rule.

What do HIPAA standards address?

No. Disclosure for treatment is generally permitted without a separate HIPAA authorization, subject to applicable rules.

A clinic shares PHI with a specialist for treatment. Is a HIPAA authorization generally required?

Protection of information and systems against unauthorized access, use, disclosure, alteration, disruption, or destruction while maintaining its confidentiality, integrity, and availability.

What is information security?

The process of identifying potential threats and vulnerabilities to electronic protected health information (ePHI) and assessing the likelihood and impact of those risks.

What is risk analysis in healthcare information security?

What is a major threat to healthcare data security?

Human factors, including phishing, mistakes, misuse of access, and stolen credentials, are major threats.

Regularly and whenever significant operational or environmental changes occur

How often should security policies and procedures be reviewed?

A federal rule requiring administrative, physical, and technical safeguards for electronic protected health information.

What is the HIPAA Security Rule?

Policies and processes for security management, workforce training, access management, incident response, and contingency planning.

What are HIPAA Security Rule administrative safeguards?

A requirement to implement policies and procedures protecting electronic PHI from improper alteration or destruction.

What is the HIPAA data integrity standard?

Management policies, procedures, and organizational measures used to direct and enforce information security.

What are administrative controls?

Safeguards that reduce information-security risks, such as authentication, encryption, access restrictions, and monitoring.

What are security controls?

Measures that protect network traffic and connections, such as firewalls, network segmentation, and secure communications.

What are network controls?

Measures protecting facilities, equipment, and physical access, such as locks, restricted areas, and workstation protections.

What are physical safeguards?

Administrative controls are policies and management processes; physical safeguards protect buildings, devices, and physical access.

Administrative controls vs. physical safeguards: what is the difference?

Security controls cover broad protections; network controls specifically protect network connections and communications.

Security controls vs. network controls: what is the difference?

The accuracy, completeness, consistency, and protection of data from unauthorized or improper change.

What is data integrity?

Access decisions based on circumstances such as user role, patient relationship, location, purpose, or workflow context.

What is context-based access?

A chronological record of system activity, such as who accessed or changed information and when.

What is an audit trail?

An audit trail documents activity and changes; data integrity means information remains accurate, complete, and appropriately protected.

Audit trail vs. data integrity: what is the difference?

A period when an information system is unavailable or cannot perform its normal functions.

What is computer downtime?

A plan for maintaining or restoring critical operations during and after a disruption.

What is a business continuity plan?

Downtime is the system outage; the continuity plan explains how essential work will continue during disruption.

Computer downtime vs. business continuity plan: what is the difference?

Follow the organization’s approved downtime procedures, document care using authorized alternatives, and reconcile information when systems return.

What should staff do during an EHR outage?

It can help identify which accounts accessed records, when access occurred, and what activity was recorded.

Why is an audit trail useful after suspected unauthorized chart access?

Key indicator

A quantifiable measure used over time to assess performance against best practice criteria is called what?

Identify the objective of the audit

Before conducting an audit, what must an organization do first?

Conflict management

What focuses on working with individuals to find a mutually acceptable solution?

True

True or false: A professional code of ethics guides members in determining right and wrong job-related conduct.

Stark Law

Which law generally restricts certain physician referrals involving financial relationships?

Copayment

What is a fixed dollar amount paid by the policyholder per covered service?