CEHRS CEHRS Data Security and Access Control 4

Question 1

Which federal regulation specifically governs the security of electronic protected health information (ePHI) in the United States?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule specifically establishes national standards for protecting ePHI that is created, received, used, or maintained by covered entities.

Question 2

A clinic employee shares their EHR login credentials with a coworker to cover for them during break. This violates which security principle?

Accepted Answer

Individual accountability

Answer

Sharing credentials violates individual accountability, which requires that each user be uniquely identified so their actions in the system can be traced.

Question 3

Which type of access control assigns permissions based on job function rather than individual identity?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Role-Based Access Control (RBAC) grants permissions according to the user's role or job function within the organization.

Question 4

A breach notification must be sent to HHS and affected individuals within how many days of discovering a HIPAA breach affecting 500 or more individuals?

Accepted Answer

60 days

Answer

HIPAA requires breach notification to affected individuals and HHS within 60 days of discovery of a breach affecting 500 or more individuals.

Question 5

Which encryption standard is currently recommended by NIST for protecting ePHI at rest?

Accepted Answer

AES-128 or higher

Answer

NIST recommends AES (Advanced Encryption Standard) with a key length of 128 bits or higher for encrypting data at rest.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS CEHRS Data Security and Access Control 4