Policy Management and Regulatory Compliance

Abstract

Policy management and regulatory compliance extend well beyond administrative management and touches all levels of an organization. The role of an imaging informatics professional is to be knowledgeable on organizational, local, state, and federal requirements and to assure that his area of responsibility is in compliance with these requirements. This chapter covers the most significant federal regulations that currently impact the imaging informatics professional. The chapter ends with a review of the requirements for professional certification in imaging informatics.

Self-Assessment Questions

• 1. Protected Health Information (PHI) is defined as

  • a. All information that is available at the patient or study demographics level.

  • b. Any information that can be used to identify an individual at the patient demographics level.

  • c. Any information that can be used to identify an individual at the study demographics level.

  • d. Any information that can be used to identify an individual at the patient or study demographics level.

• 2. The Privacy Rule pertains to protected health information in any format, and specifies that “covered entities” are defined exclusively as

  • a. Business associates of healthcare entities.

  • b. Healthcare entities.

  • c. Healthcare entities and business associates.

  • d. Healthcare payors.

• 3. The primary officer responsible for ensuring that an organization meets HIPAA requirements

  • a. HIPAA compliance officer

  • b. HIPAA privacy officer

  • c. HIPAA regulatory officer

  • d. HIPAA security officer

• 4. According to HIPAA, transmission security requires

  • a. Integrity controls and the encryption of data that are exchanged between applications.

  • b. Integrity controls and the encryption of data that are exchanged between local servers.

  • c. Integrity controls and the encryption of data that are exchanged between remote locations.

  • d. Integrity controls and the encryption of data are not required by HIPAA transmission security.

• 5. The Security Rule identifies three categories of safeguards for HIPAA compliance:

  • a. Administrative, legal, and technical.

  • b. Administrative, physical, and technical.

  • c. Legal, physical, and technical.

  • d. Authentication, encryption, and automatic logoffs.

• 6. The Mammography Quality Standards Act (MQSA) establishes national standards for mammography and is regulated by the

  • a. American College of Radiology.

  • b. Centers for Medicare and Medicaid Services.

  • c. Department of Health and Human Services.

  • d. Food and Drug Administration.

• 7. MQSA certification must be renewed

  • a. Every year.

  • b. Every 2 years.

  • c. Every 3 years.

  • d. Every 5 years.

• 8. The minimum native resolution for full-field digital mammography must be at least

  • a. 1 line pair per millimeter.

  • b. 2 line pairs per millimeter.

  • c. 5 line pairs per millimeter.

  • d. 10 line pairs per millimeter.

• 9. Which of the following is true regarding mammography films that have been digitized?

  • a. Can be used for primary diagnosis and comparison studies and can be used as a substitute for film for long-term archiving.

  • b. Can be used for primary diagnosis and comparison studies and cannot be used as a substitute for film for long-term archiving.

  • c. Can be used for comparison only and not for primary diagnosis and can be used as a substitute for long-term archiving.

  • d. Can be used for comparison only and not for primary diagnosis and cannot be used as a substitute for long-term archiving.

• 10. According to MQSA, it is permissible to electronically transfer mammography images specifically if

  • a. The data are transferred in lossless compression format and are acceptable to the sending party.

  • b. The data are transferred in lossless compression format and are acceptable to the receiving party.

  • c. The data are transferred in lossy or lossless compression format and are acceptable to the sending party.

  • d. The data are transferred in lossy or lossless compression format and are acceptable to the receiving party.