Feb 01, 2010 07:02 am |
posted by Chris Dimick |
ARRA & Privacy and security
In September 2009 the Department of Health and Human Services released an interim final rule describing a covered entity’s responsibilities to notify victims of a breach to their personal health information. The new rule was the result of provisions in the American Recovery and Reinvestment Act. Penalties for noncompliance take effect February 22, 2010.
How well do you know the ins and outs of the rule? It’s complicated, and there are many moving parts. Test your knowledge on the four following breach scenarios. Select the one best answer for each scenario. Each correct answer is based directly on a given section of the rule.
Download a PDF of the scenarios here, which includes commentary from the IFR and results of a poll of 500 AHIMA members who were quizzed on the scenarios already.
Scenario 1
Inadvertent disclosure of deceased patient information
General Hospital recently provided Mr. J. Smith with a copy of his complete medical record from his last visit. Accidently contained within the copies was the history and physical report of Mr. Robert Lewis. Mr. Smith, who is dissatisfied with General Hospital, called the HIM department to report the misdirected history and physical, complaining that the mistake was just another example of the substandard practices at General Hospital.
Mr. Smith refused to return the history and physical. He insisted he would call Mr. Lewis personally to inform him of the hospital’s incompetence. Further investigation revealed that Mr. Lewis is deceased. The hospital’s records do indicate the name and address of Mr. Lewis’s next of kin. In response to this breach the hospital should:
- Do nothing, because Mr. Lewis is deceased.
- Notify the hospital attorney. Secure a court order and seize the records from Mr. Smith.
- Notify Mr. Lewis’s next of kin. Notify the security incident response team. Contact Mr. Smith and formally ask that he return the history and physical to the hospital.
- Arrange for a face-to-face meeting with Mr. Smith to seek return of the history and physical.
Answer:
Show ▼
3. §164.404(d)(1)(ii) of the interim final rule requires that if the individual is deceased, notice must be sent to the last known address of the next of kin or personal representative, if the address is on file.
.
Scenario 2
Missing back-up tape
A hospital back-up tape containing unencrypted health information, names, and Social Security numbers of thousands of patients is lost or possibly stolen in delivery to off-site storage. The healthcare organization serves patients across a five-state area, with thousands of victims located in each of the states. In response to this security breach the organization should:
- Comply with the breach notification regulations of all five states. File a year-end report with the secretary of Health and Human Services.
- Comply with the breach notification regulations of the state in which healthcare organization is incorporated. Follow federal breach notification regulations by notifying victims and the secretary of Health and Human Services. Do not notify the media.
- Comply with all applicable federal breach notification requirements only.
- Comply with the breach notification regulations of all five states. Comply with federal breach notification regulations by notifying the victims, the secretary of Health and Human Services, and major media in each state without unreasonable delay.
Answer:
Show ▼
4. Because the breach poses reasonable risk of harm, and because it involves more than 500 people in total, it requires notification of individuals (§164.404) and the HHS secretary (§164.408) without unreasonable delay. Because the breach involves more than 500 people in each state, §164.406 requires notification of major media in each state.
Federal regulations do not preempt state laws, and entities thus must comply with state law as appropriate. Further, entities must comply with laws for those states within which the breach victims reside.
.
Scenario 3
Misdirected e-mail within network
A clinical laboratory staff member accidently e-mails patient biopsy reports to the office of an urgent care center. The urgent care center is affiliated with the same healthcare network as the clinical laboratory.
The employee of the urgent care center notifies the clinical laboratory supervisor of the misdirected e-mail. The supervisor instructs the employee to delete the e-mail, and the clinical laboratory receives a confirmation that the e-mail was deleted. In response to this misdirected e-mail, the organization should:
- Do nothing, because the e-mail has been deleted.
- Send a breach notification to every patients whose biopsy report was in the e-mail.
- Document the determination that the incident does not represent a significant risk of harm. Do not send a breach notification.
- Inform both employees that they are under investigation. Suspend the employee responsible for sending the misdirected e-mail pending a further forensic investigation. Seize the computer of the employee receiving the misdirected e-mail and perform an audit for inappropriate activity.
Answer:
Show ▼
3. The misdirected e-mail was an unintentional access by a workforce member of the covered entity. It was made in good faith and within the scope of authority, and it did not result in further use or disclosures in a manner not permitted by the privacy rule. The clinical laboratory is responsible for documenting this determination, however.
.
Scenario 4
Patient names disclosed outside the network
A list of clinic patient names is accidentally sent to a physician’s office that is not affiliated with the clinic. The list does not include the name of the clinic or any other identifying information about the patients.
The doctor receiving the misdirected list mails it back to the clinic. No other use or disclosure was made of the list. In response to this incident the clinic should:
- Do nothing, because the list was returned.
- Send a breach notification to every patient on the list.
- Document the determination that the incident does not represent a significant risk of harm. Do not send a breach notification.
- Because the physician’s office viewed the list of patient names, it would be required to issue breach notification letters to all individuals on the list.
Answer:
Show ▼
3. The names on the list are not linked to a healthcare provider, diagnosis, or treatment. Thus no privacy rule violation or security breach resulting in harm to the individuals has occurred. The clinic is responsible for documenting this determination, however.
Use for an organization’s internal educational purposes permissible without request as long as proper citation is made. Commercial use is not permitted. A version of scenario 1 was originally published in the February 2010 print edition.
Comments are moderated, and there may be a delay before your comment is posted.
XHTML TAGS ARE ALLOWED.
This was a good “quiz” for practice in today’s health care environment. Thanks for making it accessible for me, as a student and HIM worker.
— Lindy Jones
February 4th, 2010 at 10:59 am
Thank you for this quiz, they are very useful for me to test my knowledge and identify areas of weakness.
I hope we can have more of these quizes.
— David Rothery
February 4th, 2010 at 11:21 am
I enjoyed this quiz. It was informative and it allowed me to test my knowledge of these rules. keep the quizzes coming
— Florestine Douglas
February 4th, 2010 at 6:18 pm
I enjoyed taking the quiz. These are issues that happen everyday somewhere and it just reinforced what we need to know.
— Susan Richardson, RHIA
February 7th, 2010 at 3:43 pm
Excellent scenarios as examples of realistic occurrences we face.
— Sheryl Rose
February 12th, 2010 at 5:47 pm
They talk about what to report annually and if over 500 unsecure releases, but what if you don’t have any, do you just not report anything?
— Carolyn
February 25th, 2010 at 11:30 pm
Thanks for the chance to review security breach scenarios. This is very useful.
— Margaret M. Tufty, RHIT
March 5th, 2010 at 3:35 pm
I enjoy the scenarios. It keeps you up to date with the new rules. This is also very informative, useful, and it’s also a good way to review situations like these to see if you have retained the knowledge needed to apply the rules.
— Sheila White
March 11th, 2010 at 9:24 am
We’re glad here at the Journal that the scenarios are useful. A special thanks to AHIMA’s Privacy and Security Practice Council, who drafted them. What other scenarios, quizzes, or polls would be helpful?
— Kevin Heubusch
March 11th, 2010 at 4:20 pm
This was very helpful and actually answered a question I was resarching. I appreicate all the effort put into this type of exercise for us to test our knowledge.
— Susan Spencer
March 25th, 2010 at 9:11 pm
I found these scenarios extremely helpful and beneficial, please keep them coming. What a wonderful learning tool.
Paula
— Paula Eubanks
March 26th, 2010 at 10:19 pm
Thank you for developing these scenarios. They were very helpful and helped test my knowledge of the HITECH rule.
— Brenda W. Tuck
April 26th, 2010 at 7:18 pm
Great practice! Will forward these to the rest of our Privacy Team so everyone can test themselves. Please keep these types of scenarios coming!
— Celeste Snodgrass
April 29th, 2010 at 9:52 am
Excellent quiz. As an employee of a covered entity and privacy leader, its nice to confirm that I have a clear understanding of potential breach situations.
— Catherine
May 27th, 2010 at 8:18 am
We had a operative report faxed to a wrong number. As luck would have it, it was another fax machine to a local machine shop. They contact our facility about the mishap and we instructed them to destroy the fax. They agreed. What steps, if any, do we need to take since the information was destroyed?
— Steven
July 29th, 2010 at 3:25 pm
These are very good. Do you have some regarding correctional healthcare?
— Vernika
September 18th, 2010 at 6:34 pm
Thanks for providing such a wonderful tool to review and “test” our knowledge.
— Tammy Gant
December 20th, 2010 at 7:53 pm
I really enjoyed this quiz. I was very surprised to see it on the website. I look forward to more practice.
Thank you.
— Allison Freeman
April 13th, 2011 at 1:57 pm
Excellent quiz. I enjoyed testing my knowledge. I look forward to taking more quizes.
— Debbie Corbin RHIT
April 18th, 2011 at 7:02 am
This is very educative and informative and I look forward to reading more. Thanks for providing it.
— Ebele Achonu RHIA
July 21st, 2011 at 9:55 am
Yes, where is the PDF file that shows the readers’ responses to your quiz? That would be informative.
Laura
— Laura Blalock
November 8th, 2012 at 12:44 pm
Please scratch that message… I found the link to download : )
— Laura Blalock
November 8th, 2012 at 12:45 pm