CEHRS CEHRS Data Security and Access Control 1

Question 1

Which HIPAA rule specifically addresses the safeguarding of electronic protected health information (ePHI)?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule establishes national standards to protect electronic protected health information (ePHI) created, received, maintained, or transmitted by covered entities.

Question 2

What is the principle of 'minimum necessary' access in EHR security?

Accepted Answer

Users should only access the minimum amount of PHI needed to perform their job functions

Answer

The minimum necessary principle requires that access to PHI be limited to only what is needed for an employee to perform their specific job duties.

Question 3

Which type of EHR access control assigns permissions based on a user's job role or title?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Role-Based Access Control (RBAC) assigns system permissions to users based on their organizational role, such as nurse, physician, or billing staff.

Question 4

What is the purpose of an EHR audit log?

Accepted Answer

To record who accessed patient records, what was viewed, and when

Answer

EHR audit logs create a chronological record of all user access to patient records, including who accessed information, what was viewed or changed, and the timestamp.

Question 5

Which authentication method requires users to verify identity using something they know AND something they have?

Accepted Answer

Multi-factor authentication (MFA)

Answer

Multi-factor authentication requires at least two verification factors — typically a password (something you know) plus a code sent to a device (something you have).

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS CEHRS Data Security and Access Control 1