Technology, Data Security, and Interoperability
Domain 9: Technology, Data Security, and Interoperability
This domain tests RCM systems, HIPAA privacy and security, breach notification, and health data exchange.
Core rules
- HIPAA Security Rule safeguards are administrative, physical, and technical; a risk analysis is required.
- Privacy Rule: minimum necessary, permitted uses, patient rights, and business associate agreements with vendors.
- Breach notification: notify individuals and HHS without unreasonable delay and no later than 60 days; breaches affecting fewer than 500 individuals are logged annually to HHS.
- HITECH strengthened enforcement and breach notification requirements.
- 42 CFR Part 2 protects substance use disorder records and requires specific consent.
- Interoperability standards include HL7 v2, FHIR, C-CDA, and X12 5010; TEFCA and USCDI support exchange.
- Information blocking: the Cures Act prohibits practices that interfere with access, subject to exceptions.
- RCM technology includes practice management, EHR, clearinghouse, contract management, and analytics systems; validate interfaces and access controls.
Worked example
A laptop with unencrypted PHI for 600 patients is stolen. The entity must notify affected individuals and HHS within 60 days; because 600 is at least 500, media notice may also be required. Encryption would have supported a safe harbor. Document the risk assessment and remediation.
Traps
Assuming encryption is optional; missing business associate agreements; treating all incidents as reportable without a risk assessment; ignoring information blocking; confusing privacy and security rules.