CHPC flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Covered Entity Definition

A health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in connection with a HIPAA standard transaction.

Hybrid Entity

A single legal entity that performs both covered and non-covered functions and designates its health care components in writing so HIPAA applies only to those components.

Designated Privacy Official

The individual a covered entity names as responsible for developing and implementing privacy policies and receiving complaints; contact details must appear in the notice of privacy practices.

Three Lines of Defense

A governance model in which operational staff own privacy risk, the privacy and compliance function monitors and advises, and internal audit provides independent assurance to the board.

HIPAA Preemption Standard

HIPAA sets a federal floor; a contrary state law that is more stringent, granting greater privacy protection or greater individual rights, prevails over the federal requirement.

42 CFR Part 2

Federal regulations protecting records of federally assisted substance use disorder treatment programs; they generally require patient consent before disclosure and mandate a redisclosure prohibition notice.

HITECH Act

The 2009 federal law that extended HIPAA obligations directly to business associates, created breach notification duties, strengthened penalties, and added the self-pay restriction right.

GINA Title II

A federal law barring health plans and health insurers from using genetic information for eligibility, underwriting, or premium decisions; HIPAA separately bars genetic information use for underwriting.

Minimum Necessary Standard

The requirement to limit uses and disclosures to the least PHI needed for the purpose; it does not apply to treatment, the individual's own request, authorizations, or required-by-law disclosures.

Authorization Core Elements

Required content includes a description of PHI, authorizer identity, recipient, purpose, expiration, signature and date, revocation right, refusal or conditioning statement, and redisclosure statement.

Psychotherapy Notes Authorization

A separate, specific authorization is required to use or disclose psychotherapy notes; they are excluded from the designated record set and from the accounting of disclosures.

Facility Directory

Name, location in the facility, general condition, and religious affiliation may be disclosed to people who ask for the individual by name, unless the individual objects.

Access Timeline

A covered entity must act on a request for access within 30 days and may extend once by an additional 30 days with written notice explaining the reason.

Self-Pay Restriction

When an individual pays in full out of pocket for an item or service, the covered entity must honor a request not to disclose that information to the health plan.

Accounting of Disclosures

An individual may request a list of disclosures made in the six years before the request; treatment, payment, and operations disclosures are generally excluded from the list.

Amendment Request Timing

The covered entity must act on a request to amend within 60 days, may extend once by 30 days, and on denial must document the basis and accept a statement of disagreement.

Business Associate

A person or entity, other than a member of the covered entity's workforce, that creates, receives, maintains, or transmits PHI to perform a function or service for the covered entity.

Conduit Exception

Entities that only transmit PHI without accessing its content, such as internet service providers, the postal service, and couriers, are not business associates under HIPAA.

Business Associate Agreement Elements

A written contract must address permitted uses, safeguards, breach reporting, subcontractor flow-down, assistance with individual rights, return or destruction, HHS access, and termination.

Subcontractor Flow-Down

A business associate must require any subcontractor that creates, receives, maintains, or transmits PHI on its behalf to sign an agreement with the same restrictions.

Breach Presumption

An impermissible acquisition, access, use, or disclosure is presumed to be a breach unless a documented four-factor risk assessment demonstrates a low probability of compromise.

Four-Factor Risk Assessment

The assessment considers the nature and extent of PHI involved, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent of risk mitigation.

Breach Notice Deadline

Affected individuals must be notified in writing without unreasonable delay and no later than 60 calendar days after the covered entity discovers the breach.

HHS Breach Reporting Thresholds

Breaches affecting 500 or more individuals are reported to HHS at the same time as individual notice; smaller breaches are logged and submitted within 60 days of year-end.

Training Trigger Events

Workforce members must be trained when they join the organization and whenever privacy policies or procedures materially change; attendance and content must be documented.

Non-Retaliation Provision

A covered entity may not intimidate, threaten, coerce, or retaliate against any person for filing a privacy complaint or exercising rights under the Privacy Rule.

Role-Based Training

Privacy training content is tailored to the specific PHI access and risk profile of each workforce group, such as clinical staff, researchers, registration staff, or IT.

Speak-Up Culture

An environment where staff report suspected privacy concerns without fear because leadership visibly supports reporting and sanctions are applied consistently at every level.

Monitoring vs Auditing

Monitoring is continuous, near real-time review such as access alerts and log checks; auditing is periodic, retrospective review of records and activity against defined standards.

Access Auditing

Comparing workforce system access logs against assigned patients, units, or job roles to detect snooping, VIP record access, and access to co-workers' or relatives' records.

Investigation Documentation

Intake, evidence preservation, interviews, findings, mitigation, sanction, and closure are recorded for each privacy investigation and retained for six years.

Mitigation Duty

The covered entity must lessen the harmful effects of an impermissible use or disclosure to the extent practicable and document the mitigation steps it took.