HIO-201 Questions and Answers

A coveted entity must mitigate, to the extent practicable, any harmful effect that it becomes aware of from the use or disclosure of PHI in violation of its policies and procedures or HIPAA regulations.

A covered must not in any way intimidate, retaliate, or discriminate against any individual or other entity, which files a compliant.

A covered entity may not require individuals to waive their rights as a condition for treatment, payment, enrollment in a health plan, or eligibility for benefits

A covered entity must retain the documents required by the regulations for a period of six years.

A covered entity must change its policies andprocedures to comply with HIPAAregulations no later than three years after the change in law.

Risk Management

Written Contract or Other Arrangement

Accountability

Authorization and/or Supervision

Integrity Controls

Detail specifically all activities that are considered a use or disclosure.

Describe in plain language what is meant by treatment, payment, and health care operations (TPO)

Inform the individual that protected health information (PHI) may only be used for valid medical research.

Inform the individual that this version of the Notice will always cover them, regardless of subsequent changes.

State the expiration date of the Notice.

Device and Media Controls

Access Controls

Transmission Security

Integrity

Audit Controls

PKI requirements for hospitals and health care providers.

Encryption algorithms that must be supported by hospitals and health care providers.

Fraud and abuse in the health care system and ways to eliminate the same.

Guaranteed health insurance coverage to workers and their families when they change employers.

The use of strong authentication technology that must be supported by hospitals and health care providers.

ICD-9-CM, Volumes land 2

CPT-4

CDT

ICD-9-CM, Volume 3

HCPCS

Access to the psychotherapy notes.

Request an amendment to their medical record.

Receive a digital certificate.

See an accounting of disclosures for which authorization was given.

The use of a smart card for accessing their records.

Eligibility (270/271).

Premium Payment (820).

Unsolicited Claim Status (277).

Remittance Advice (835).

Functional Acknowledgment (997).

Annual Audits

Claims Management

Salary disbursement to the workforce having direct treatment relationships.

Life Insurance underwriting

Cash given to the pharmacist for the purchase of an over-the-counter drug medicine

Designate a security officer.

Document termination procedures.

Use biometrics to authenticate transactions.

Deploy tokens and smart cards to all medical personnel.

Verify that business associates treat patient information respectfully.

A covered entity must designate, and document, a privacy official, security officer and a HIPAAcompliance officer

A covered entity must designate, and document, the same person to be both privacyofficial and as the contact person responsible for receiving complaints and providing further information about the notice required by the regulations.

A covered entity must implement and maintain written or electronic policies and procedures with respect to PHI that are designed to comply with HIPM standards, implementation specifications and other requirements.

A covered entity must train, and document the training of, at least one member of its workforce on the policies and procedures with regard to PHI as necessary and appropriate for them to carry out their function within the covered entity no later than the privacy rule compliance date

A covered entity must retain the document required by the regulations for a period often years from the time of it's creation or the time it was last in effect, which ever is later.

Security rule.

Privacy rule.

Covered entity rule.

Electronic Transactions and Code Sets rule.

Electronic Signature Rule.

Premium Payment.

Health Care Claim.

First Report of Injury.

Health Plan Enrollment and Dis-enrollment.

Coordination of Benefits.

Access Control

Security Incident Procedures

Information Access Management

Workforce Security

Security Management Process

Security Incident Procedures

Response and Reporting

Assigned Security Responsibility

Termination Procedures

Facility Access Controls

Administrative Safeguards

Physical Safeguards

Technical Safeguards

Audit Controls

Information Access Management

270

276

278

271

834

The date on which any automatic extension occurs.

Covered entity's signature.

A statement that federal privacy laws still protect the information after it is disclosed.

A statement that the individual has no right to revoke the authorization.

The date signed.

The Washington Publishing Company has the exclusive rights to publish the X12N Implementation Guides.

HHS has adopted the Implementation Guides as standards for HIPAA transactions.

The guides are intended to be instructive and need not be followed strictly.

The guides may be downloaded free from WPC's Website.

The guides explain the usage of the transaction set segments and data elements.