CHP flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Protected Health Information

Individually identifiable health information created or received by a covered entity that relates to health, care, or payment and identifies or could identify the individual.

Covered Entity

A health plan, health care clearinghouse, or health care provider that transmits health information electronically in connection with a HIPAA standard transaction.

Minimum Necessary Standard

Requires covered entities to make reasonable efforts to limit uses, disclosures, and requests for PHI to the minimum needed to accomplish the intended purpose.

De-identification Safe Harbor

A method that removes 18 specified identifiers and requires no actual knowledge that remaining information could identify the individual.

HITECH Act

The 2009 law that extended HIPAA privacy and security obligations directly to business associates and added breach notification requirements.

State Law Preemption

HIPAA sets a federal floor; contrary state law is preempted unless it is more stringent or falls within a statutory exception.

Privacy Official

The designated person responsible for developing and implementing the covered entity's privacy policies and procedures and receiving complaints.

Notice of Privacy Practices

A document describing permitted uses and disclosures, individual rights, and the entity's legal duties, provided to patients and posted publicly.

Civil Monetary Penalty Tiers

OCR penalty tiers increase with culpability, from lack of knowledge through reasonable cause to willful neglect, with willful neglect uncorrected highest.

Right of Access

An individual's right to inspect and obtain a copy of PHI in a designated record set, generally within 30 days of the request.

Reasonable Cost-Based Fee

An access fee limited to labor for copying, supplies, and postage; it may not include costs of searching for or retrieving PHI.

Right to Amend

An individual's right to request correction of PHI in a designated record set, which the entity may deny in specified circumstances.

Accounting of Disclosures

A list of disclosures of PHI made in the prior six years, excluding disclosures for treatment, payment, and health care operations.

Confidential Communications Request

A request to receive PHI by alternative means or at an alternative location, which the entity must accommodate if reasonable.

Out-of-Pocket Restriction

A restriction that must be honored when PHI pertains solely to a service paid in full out of pocket and disclosure is to a health plan.

Treatment, Payment, Operations

The three categories of use and disclosure permitted without authorization because they support core health care functions.

Limited Data Set

PHI with direct identifiers removed that may be used for research, public health, or operations under a data use agreement.

Public Health Disclosure

A permitted disclosure without authorization to public health authorities for activities such as disease reporting, injury surveillance, and FDA oversight.

Law Enforcement Disclosure

A disclosure permitted only under specific conditions such as a warrant, court order, grand jury subpoena, or statutory identification criteria.

Valid Authorization

A plain-language, signed permission describing the PHI, the parties, the purpose, an expiration, and the individual's revocation rights.

Compound Authorization

An authorization that combines multiple permissions; it may condition research treatment on signing but not other treatment or payment.

Psychotherapy Notes

Separate mental health session notes that require a specific authorization for use or disclosure, with narrow exceptions.

Business Associate

A person or entity performing functions involving PHI on behalf of a covered entity, such as billing, claims processing, or legal services.

Business Associate Agreement

A written contract establishing permitted uses, safeguards, breach reporting, and return or destruction of PHI at termination.

Conduit Exception

An exception for entities that only transmit PHI, such as internet service providers or postal services, without accessing or storing it.

Downstream Business Associate

A subcontractor that creates, receives, maintains, or transmits PHI on behalf of a business associate and requires its own agreement.

Breach Definition

An acquisition, access, use, or disclosure of PHI not permitted by the Privacy Rule that compromises the security or privacy of the PHI.

Four-Factor Risk Assessment

The analysis of PHI nature and extent, the unauthorized recipient, whether PHI was acquired or viewed, and the extent of mitigation.

Sixty-Day Notification Rule

Breaches affecting 500 or more individuals require notice to individuals, HHS, and media without unreasonable delay and within 60 days of discovery.

Risk Analysis

An ongoing process to identify and assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI.

Audit Controls

A required technical safeguard that records and examines activity in information systems that contain or use ePHI.

Privacy Incident

Any suspected or actual impermissible use or disclosure of PHI, which must be triaged to determine whether a breach occurred.