A 79-year-old male presents to your office for his annual flu shot. On physical exam you note several linear bruises on his back. Upon further questioning he denies abuse from his daughter and son-in-law, who live in the same house. The patient states he does not want this information shared with anyone. What is the most appropriate next step, paired with its justification?

Breach patient confidentiality, as this patient is a potential victim of elder abuse and reporting is mandated in most states

Breach patient confidentiality, as this patient's care should be discussed with the daughter as she is his primary caregiver

See the patient back in 2 weeks and assess whether the patient's condition has improved, as his condition is not severe

Do not break patient confidentiality, as elder abuse reporting is not mandatory

Do not break patient confidentiality, as this would potentially worsen the situation

A 45-year-old man is brought to the emergency department by his friends because of a 1-hour history of shortness of breath and squeezing chest pain. They were at a party where cocaine was consumed. A diagnosis of acute myocardial infarction is made. The physician stabilizes the patient and transfers him to the inpatient unit. Six hours later, his wife arrives at the emergency department and requests information about her husband's condition. Which of the following is the most appropriate action by the physician?

Obtain authorization from the patient to release information

Ask the wife for a marriage certificate

Inform the wife about her husband's condition

Consult the hospital ethics committee

Request the patient's durable power of attorney document

A 62-year-old man comes to his primary care physician with a 3-month history of insomnia and severe work anxiety. He says that he is unable to retire because he has no financial resources; however, the stress level at his work has been causing him to have worsening performance and he is afraid of being fired. He thinks that he would be able to resume work normally if he was able to decrease his level of anxiety. His physician prescribes him a trial 1-month regimen of benzodiazepine therapy and schedules a follow-up appointment to see whether this treatment has been effective. Three weeks later, the patient's wife calls and says "My husband was fired from work and it's your fault for prescribing that medication! I know he must have been taking too much of that drug. Don't you know that he had a horrible problem with drug abuse in his 30s?" Which of the following is the most appropriate first action for the physician to take?

Contact the patient directly to discuss the situation

Discharge the patient for inappropriate use of medication

Contact the physician's medical practice insurance company regarding a potential claim

Refer the patient to a substance abuse program

Inform the patient's wife that patient information cannot be disclosed to her due to HIPAA

A 26-year-old man comes to the emergency department because of a 1-week history of fever, throat pain, and difficulty swallowing. Head and neck examination shows an erythematous pharynx with purulent exudates overlying the palatine tonsils. Microscopic examination of a throat culture shows pink, spherical bacteria arranged in chains. Treatment with amoxicillin is initiated. A day later, a physician colleague from another department approaches the physician in the lobby of the hospital and asks about this patient, saying, "Did you see him? What does he have? He's someone I play football with and he hasn't come to play for the past 5 days. I'm worried about him." Which of the following is the most appropriate action by the physician?

Inform the colleague that they cannot divulge any information about the patient

Inform the colleague that they should ask the patient's attending physician

Tell the colleague the patient's case file number so they can look it up themselves

Tell the colleague that they cannot tell them the diagnosis but that their friend was treated with antibiotics

Ask the colleague to meet in the office so they can discuss the patient in private

An 86-year-old man is admitted to the hospital for management of pneumonia. His hospital course has been relatively uneventful, and he is progressing well. On morning rounds nearing the end of the patient's hospital stay, the patient's cousin finally arrives to the hospital for the first time after not being present for most of the patient's hospitalization. He asks about the patient's prognosis and potential future discharge date as he is the primary caretaker of the patient and needs to plan for his arrival home. The patient is doing well and can likely be discharged in the next few days. Which of the following is the most appropriate course of action?

Bring the cousin to the room and ask the patient if it is acceptable to disclose his course

Bring the cousin to the room and explain the plan to both the patient and cousin

Explain the plan to discharge the patient in the next few days

Explain that you cannot discuss the patient's care at this time

Tell the cousin that you do not know the patient's course well

A 28-year-old male presents to his primary care physician with complaints of intermittent abdominal pain and alternating bouts of constipation and diarrhea. His medical chart is not significant for any past medical problems or prior surgeries. He is not prescribed any current medications. Which of the following questions would be the most useful next question in eliciting further history from this patient?

"Can you tell me more about the symptoms you have been experiencing?"

"Does the diarrhea typically precede the constipation, or vice-versa?"

"Is the diarrhea foul-smelling?"

"Please rate your abdominal pain on a scale of 1-10, with 10 being the worst pain of your life"

"Are the symptoms worse in the morning or at night?"

A 72-year-old woman is brought to the emergency department with dyspnea for 2 days. She is on regular hemodialysis at 3 sessions a week but missed her last session due to an unexpected trip. She has a history of congestive heart failure. After urgent hemodialysis, the patient’s dyspnea does not improve as expected. The cardiologist is consulted. After evaluation of the patient, he notes in the patient’s electronic record: “the patient does not have a chronic heart condition and a cardiac cause of dyspnea is unlikely.” The following morning, the nurse finds the cardiologist’s notes about the patient not having congestive heart failure odd. The patient had a clear history of congestive heart failure with an ejection fraction of 35%. After further investigation, the nurse realizes that the cardiologist evaluated the patient’s roommate. She is an elderly woman with a similar first name. She is also on chronic hemodialysis. To prevent similar future errors, the most appropriate strategy is to use which of the following?

Two patient identifiers at every patient encounter by any healthcare provider

Two patient identifiers at every nurse-patient encounter

A patient’s medical identification number at every encounter by any healthcare provider

Two patient identifiers at every physician-patient encounter

A patient’s medical identification number at every physician-patient encounter

On a Sunday afternoon, a surgical oncologist and his family attend a football game in the city where he practices. While at the game, he runs into a physician colleague that works at the same institution. After some casual small talk, his colleague inquires, "Are you taking care of Mr. Clarke, my personal trainer? I heard through the grapevine that he has melanoma, and I didn't know if you have started him on any chemotherapy or performed any surgical intervention yet. Hopefully you'll be able to take very good care of him." In this situation, the surgical oncologist may confirm which of the following?

Only that Mr. Clarke is his patient

Security Rule requirements for USMLE Step 1: High-Yield Patient Safety Lessons

Security Rule - The ePHI Guardian

Mandates protection for all electronically protected health information (ePHI) created, received, used, or maintained by a covered entity. Focuses on confidentiality, integrity, and availability.

Administrative Safeguards: Risk analysis, security officer designation, workforce training, contingency plan.
Physical Safeguards: Facility access controls, workstation & device security, secure server rooms.
Technical Safeguards: Unique user IDs, audit controls, encryption, transmission security.

⭐ The Rule is flexible, distinguishing between "required" and "addressable" implementation specifications based on entity-specific risk analysis.

The 3 Types of HIPAA Safeguards: Admin, Physical, Technical

Administrative Safeguards - People & Policies

Security Management Process:
- Conduct a formal Risk Analysis of potential threats to ePHI.
- Implement Risk Management measures to mitigate identified risks.
Assigned Security Responsibility:
- Designate a specific Security Official to oversee all security policies.
Workforce Security:
- Procedures for authorizing, supervising, and terminating workforce ePHI access.
Information Access Management:
- Restrict access based on user roles ("minimum necessary" principle).
Security Awareness & Training:
- Mandatory, periodic training for all staff on security policies (e.g., malware, passwords).
Contingency & Incident Plan:
- Establish policies for data backup, disaster recovery, and incident response.

⭐ A covered entity must designate a specific Security Official responsible for developing and implementing all required security policies and procedures.

The 3 Types of HIPAA Safeguards

Physical Safeguards - Locks, Doors & Devices

Facility Access Controls: Secure physical access to areas containing ePHI. Implements locks, alarms, and key-card systems to restrict entry to authorized staff only.
Workstation Security: Governs the physical environment of workstations accessing ePHI.
- Position screens away from public view.
- Implement automatic log-off policies after inactivity.
Device & Media Controls: Policies for handling hardware and media.
- Disposal: Render ePHI unrecoverable via pulverizing, melting, or degaussing.
- Re-Use: Securely wipe data before re-using devices.

⭐ Improper disposal of devices containing ePHI is a common HIPAA violation. Policies must ensure data is permanently destroyed (e.g., degaussing, physical destruction), not just deleted.

Simplified Access Control Architecture Diagram

Technical Safeguards - The Digital Fortress

Access Control: Limiting access to authorized personnel.
- Unique User Identification: Assigning a unique name/number for tracking.
- Emergency Access Procedure: Ensuring data availability during crises.
- Automatic Logoff: Terminating sessions after a period of inactivity.
Audit Controls: Hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI.
Integrity: Policies and procedures to protect ePHI from improper alteration or destruction.
Transmission Security: Guarding against unauthorized access to ePHI being transmitted over a network.
- Encryption is the primary method.

⭐ High-Yield Fact: Encryption is an "addressable" safeguard, but if not used, an equivalent measure must be implemented. It renders ePHI unusable, unreadable, or indecipherable to unauthorized individuals.

HIPAA Security Rule Safeguards for ePHI

High‑Yield Points - ⚡ Biggest Takeaways

The Security Rule applies exclusively to electronic protected health information (e-PHI).

It mandates three core safeguards: Administrative, Physical, and Technical.

Administrative safeguards include performing a risk analysis and designating a security official.

Physical safeguards focus on controlling access to facilities and securing workstations.

Technical safeguards require access controls (unique user IDs), audit logs, and encryption of e-PHI during transmission.

Continue reading on Oncourse

CONTINUE READING — FREE

or get the app

App Store|Google Play