Generally HIPPA
Why do we want to protect patients information?
To protect residents from identity fraud, among other cybersecurity concerns
A hospital’s public website lists a patient’s first name next to their diagnosis for educational purposes. Is this Protected Health Information (PHI) under HIPAA?
YES
it is individually identifiable health information held by a covered entity, even if published online
State what the HIPPA acronym stands for?
Health Insurance Portability and Accountability Act
True or False
Healthcare workers can go to jail for selling resident information.
TRUE! Penalties can be up to $250,000 or 10 years in jail
What is the Privacy Rule?
Limits uses/disclosure of PHI without authorization
name three things that are considered PHI(Protected Health Information)?
Name, Address, Dates, phone number, fax address, email address, social security number, medical records
A medical courier is given a patient’s chart to deliver to another clinic. Can the courier use the PHI for personal needs?
NO
a business associate may not use PHI for personal purposes; they must have a Business Associate Agreement (BAA) and follow HIPAA rules
What does HIPPA seek to address in Senior Living?
Growing concerns surrounding the privacy and security of healthcare data.
True OR False
The HIPPA Privacy Rule applies only to written information
FALSE
PHI can be in any form
What is the Security Rule?
Standards for protecting electronic PHI
What is the goal of HIPPA?
The goal of HIPAA is to keep Protected Health Information strictly confidential while allowing for the convenience of keeping and transmitting electronic records.
A clinic stores ePHI on a shared office computer without encryption. Which Security Rule safeguards are violatied?
A. Administrative
B. Safeguards
C. Technical
D. All of the above
D. ALL OF THE ABOVE
When was HIPPA enacted into law?
1996
True or False
Patient's information should be thrown away in an unlocked bin unless it has been shredded or otherwise destroyed.
False
The HIPPA Privacy Rule requires covered entities to apply appropriate administrative, technical and physical safeguards to protect PHI including during disposal
What is the Breach Notification Rule?
Requires covered entities and business associates to notify affected individuals, HHS, and sometimes the media within 60 days after discovering a breach of unsecured protected health information
What is the maximum Civil Penalty for a HIPPA violation?
Up to $2,113,483 per violation
A researcher wants to use de‑identified data from a clinic for a study. Does HIPAA require consent for this use?
NO
if the data is truly de‑identified under HIPAA standards, it is not PHI and does not require consent
When staff members suspect a breach of patient information who should they report to?
A privacy officer or compliance officer
True or False
A patient can access their PHI whenever they want
True
In any case a resident themselves requests access to their PHI they can do so.
What is the Enforcement Rule?
The HIPAA Enforcement Rule is a federal regulation that outlines how the U.S. Department of Health and Human Services (HHS) investigates HIPAA violations and imposes civil and criminal penalties on covered entities and business associates.
What is the most common HIPPA breach in senior living organizations?
Leaving a computer unlocked.
A patient is in a life‑threatening situation, and the provider needs to share information with another hospital. Can the provider disclose PHI without patient authorization?
YES
HIPAA allows disclosure for treatment in emergencies without prior authorization
For how long are HIPPA protections in place on residents PHI after they are deceased?
50 years.
True or False
A patient care staff member who leaves a patient chart open to go get a quick coffee is violating HIPPA
True
Leaving PHI visible in plain sight is a privacy violation
What is the Omnibus Rule?
The Omnibus Rule, issued by the U.S. Department of Health and Human Services (HHS) in January 2013, implemented major provisions of the HITECH Act and the Genetic Information Nondiscrimination Act (GINA). It consolidated four HIPAA rules—Privacy, Security, Breach Notification, and Enforcement—into one updated framework.