The right of the patient to control to whom their health information is disclosed.

Health care provider, health plan and health care clearing house.

For information to be PHI (Protected Health Information) it must meet a ____________.

If a business associate or covered entity only accesses a persons PHI on a “need to know” basis, they are meeting which requirement.

Measures that are taken to control access and protect information from unauthorized disclosure, alteration, destruction or loss.

A person or organization that performs functions or activities on behalf of a covered entity, but is not a part of the covered entity.

PHI can exist in these four forms.

Records maintained by or for a covered entity including medical records, billing records, and enrollment, payment, claims, adjudication, and case or medical management record systems.

Ensure workforce compliance.

A contract that lists specific responsibilities associated with patient information, initiated by a covered entity for a person or organization to sign.

The information had this removed to deidentify PHI is this method.

A record that could be disclosed in response to requests for legally admissible health records.

Safeguard the information.

Covered entities paid employees.

A data set that excludes the most direct identifiers of a person.

The information not included in the DHR or LHR.

Enacted by Congress in 1996.

A BAA must meet HIPAA and __________ requirements.

It takes this long for health information to lose its PHI status.

The three ways PHI is handled, according to HIPAA.