Leadership, Policy, and Compliance
What to know
This domain tests policy, law, ethics, and leadership. Know HIPAA (Privacy Rule, Security Rule, minimum necessary, breach notification), HITECH (meaningful use, strengthened enforcement), and the information security triad (confidentiality, integrity, availability). Understand access controls (role-based, least privilege), audit trails, and security safeguards (administrative, physical, technical). Know informed consent, data sharing, and secondary use rules. Leadership content includes strategic planning, project management (scope, schedule, budget; scope creep), change management, governance structures, and ethical decision-making (beneficence, nonmaleficence, autonomy, justice). Familiarity with regulatory bodies (CMS, ONC, Joint Commission) and policy development lifecycle helps.
Traps
- Confusing Privacy Rule (use/disclosure of PHI) with Security Rule (safeguards for ePHI).
- Assuming role-based access means everyone with a role sees everything-least privilege still applies.
- Forgetting breach notification timelines and that encryption can create a safe harbor.
- Treating scope creep as harmless; unmanaged scope threatens schedule and budget.
Worked example / rule of thumb
A clinician accesses a celebrity's record out of curiosity. This is a privacy breach and a security/audit violation; the response includes audit review, sanction, and breach assessment. Rule of thumb: Privacy = who may use/disclose PHI; Security = how ePHI is protected; audit trails prove both.
Key concepts
HIPAA Privacy vs Security, HITECH, CIA triad, least privilege, audit trails, breach notification, project scope management, ethics principles.