CEHRS CEHRS Data Security and Access Control

Question 1

Which HIPAA rule specifically addresses the safeguarding of electronic protected health information (ePHI)?

Accepted Answer

HIPAA Security Rule

Answer

HIPAA Privacy Rule

Answer

HIPAA Breach Notification Rule

Answer

HIPAA Enforcement Rule

Question 2

What is the principle of 'minimum necessary' access in EHR security?

Accepted Answer

Users should only access the minimum amount of PHI needed to perform their job functions

Answer

Passwords must meet a minimum length of 8 characters

Answer

EHR systems must use the minimum required encryption standards

Answer

Audit logs must capture the minimum data elements required by HIPAA

Question 3

Which type of EHR access control assigns permissions based on a user's job role or title?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Discretionary Access Control (DAC)

Answer

Mandatory Access Control (MAC)

Answer

Attribute-Based Access Control (ABAC)

Question 4

What is the purpose of an EHR audit log?

Accepted Answer

To record who accessed patient records, what was viewed, and when

Answer

To document system downtime and maintenance windows

Answer

To track billing codes entered by medical coders

Answer

To log network traffic for IT infrastructure management

Question 5

Which authentication method requires users to verify identity using something they know AND something they have?

Accepted Answer

Multi-factor authentication (MFA)

Answer

Single sign-on (SSO)

Answer

Biometric authentication

Answer

Certificate-based authentication

Question 6

What action should an EHR specialist take when they suspect unauthorized access to patient records?

Accepted Answer

Report the incident to the privacy/security officer immediately

Answer

Reset the affected user's password and monitor the account

Answer

Delete the audit log entries related to the incident

Answer

Notify the affected patient directly before reporting internally