CEHRS CEHRS Data Security and Access Control 5

Question 1

A patient requests that their EHR not be shared with their insurance company. Under HIPAA, the provider MUST honor this request if:

Accepted Answer

The patient pays out of pocket in full for the service

Answer

Under the HITECH Act amendment to HIPAA, providers must honor a patient's request to restrict disclosure to a health plan if the patient pays for the service entirely out of pocket.

Question 2

Which of the following BEST describes a 'minimum necessary' standard in the context of EHR access?

Accepted Answer

Employees should access only the ePHI required to perform their job duties

Answer

The minimum necessary standard requires that access to PHI be limited to what is needed to accomplish the intended purpose or job function.

Question 3

An EHR system automatically logs out a user after 15 minutes of inactivity. This is an example of which HIPAA technical safeguard?

Accepted Answer

Automatic logoff

Answer

Automatic logoff is a HIPAA technical safeguard that terminates an electronic session after a predetermined period of inactivity to prevent unauthorized access.

Question 4

Which of the following is a physical safeguard required under the HIPAA Security Rule?

Accepted Answer

Facility access controls

Answer

Facility access controls are a physical safeguard that limits physical access to electronic information systems and the buildings where they are housed.

Question 5

A ransomware attack encrypts patient records in an EHR system and demands payment for decryption. Under HIPAA, this event is presumed to be:

Accepted Answer

A breach unless a risk assessment demonstrates low probability of PHI compromise

Answer

Per 2016 HHS guidance, ransomware attacks are presumed to be HIPAA breaches unless a risk assessment shows low probability that PHI was compromised.

(CEHRS) Certified Electronic Health Records Specialist Practice Test

(CEHRS) Certified Electronic Health Records Specialist Practice Test

CEHRS CEHRS Data Security and Access Control 5