CHPS flashcards
CHPS · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Minimum necessary standard
- Requires limiting uses, disclosures, and requests for protected information to the least amount reasonably needed to accomplish the intended purpose, excluding treatment disclosures to providers.
- Policy hierarchy order
- Law and regulation outrank organizational policy, which outranks standards, then procedures, then work instructions; lower tiers cannot contradict higher tiers.
- Sanction policy purpose
- Documents graduated consequences for workforce members who violate privacy or security policies, up to and including termination, satisfying an administrative safeguard requirement.
- Business associate agreement clauses
- Written contract requiring safeguards, breach reporting, subcontractor flow-down, individual rights assistance, and return or destruction of data at termination.
- Compliance documentation retention
- Policies, training records, risk analyses, and agreements are retained for the period set by law, commonly six years from creation or last effective date.
- Program oversight reporting metrics
- Quantitative measures such as training completion rate, access review completion, incident counts, and remediation status reported to the governing committee.
- Workforce training control
- Requires initial privacy and security training before system access plus recurring refreshers at a defined interval, with completion records retained as evidence.
- Designated privacy official
- Named accountable individual responsible for developing, implementing, and overseeing the privacy program and serving as the contact point for privacy matters.
- HIPAA Privacy Rule scope
- Governs permissible uses and disclosures of protected health information by covered entities and business associates, plus individual rights and authorization requirements.
- HIPAA Security Rule scope
- Applies only to electronic protected health information and requires administrative, physical, and technical safeguards plus organizational and documentation requirements.
- HIPAA 18 identifiers
- Enumerated identifiers including names, dates except year, geographic units smaller than state, SSNs, biometrics, and full-face photos used in de-identification.
- Safe harbor de-identification
- Removes all 18 identifiers and requires no actual knowledge that remaining information could identify an individual.
- Expert determination method
- A person with appropriate statistical and scientific knowledge certifies that re-identification risk is very small and documents the methods and results.
- HIPAA individual notice deadline
- Breach notification to affected individuals without unreasonable delay and no later than 60 days after the breach is discovered.
- Valid authorization elements
- Requires description of information, purpose, expiration or event, signature, right to revoke, right to refuse, and redisclosure statement.
- Right of access timeline
- Covered entities must provide requested records within 30 days, with one possible 30-day extension if a written explanation is given.
- GDPR data principles
- Lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, and accountability.
- GDPR response deadline
- Data subject rights requests must be answered within one month, extendable by two further months for complex or numerous requests with notice.
- FERPA records
- Federal law protecting education records maintained by institutions receiving federal funds, with consent requirements and directory information exceptions.
- HIPAA risk analysis
- Required assessment of potential threats, vulnerabilities, and resulting likelihood and impact to confidentiality, integrity, and availability of ePHI.
- Addressable implementation specification
- Not optional: the entity must assess whether the safeguard is reasonable and appropriate and document the decision and any equivalent alternative.
- Annualized loss expectancy
- Quantitative risk formula: single loss expectancy multiplied by annualized rate of occurrence, used to compare safeguard costs against expected losses.
- Role-based least privilege
- Access is granted by job function and limited to the minimum necessary to perform duties, with periodic recertification and prompt revocation on role change.
- Encryption safe harbor
- Data rendered unusable, unreadable, or indecipherable to unauthorized persons may fall outside breach notification requirements under HHS guidance.
- Contingency plan elements
- Data backup, disaster recovery, emergency mode operations, testing and revision procedures, and criticality analysis for applications and data.
- Risk treatment options
- Mitigate with controls, transfer through insurance or contract, avoid by discontinuing activity, or accept with documented management sign-off.
- Audit control requirement
- Technical safeguard requiring recording and examination of information system activity, including log review for unauthorized access to sensitive records.
- Breach presumption rule
- An impermissible acquisition, access, use, or disclosure of PHI is presumed a breach unless a four-factor risk assessment demonstrates low probability of compromise.
- Four-factor breach assessment
- Considers nature and extent of PHI, the unauthorized recipient, whether PHI was actually acquired or viewed, and the extent of risk mitigation.
- Breach discovery date
- The first day the incident is known or would have been known through reasonable diligence; the 60-day notification clock starts then.
- HHS breach notification tiers
- Breaches affecting 500 or more individuals are reported contemporaneously; smaller breaches are logged and reported annually.
- Incident response phases
- Preparation, detection and analysis, containment, eradication, recovery, and post-incident lessons learned with documentation updates.