Healthcare Information Security Controls Flashcards

Which of the following best describes the concept of 'integrity' in the context of the HIPAA Security Rule?

Answer: Protecting ePHI from improper alteration or destruction

Integrity under HIPAA Security Rule means that ePHI has not been altered or destroyed in an unauthorized manner, preserving its accuracy and completeness.

Under the HIPAA Security Rule, what must a covered entity do when it terminates a workforce member's employment?

Answer: Implement a termination procedure that includes removal of system access

Workforce Security standards require covered entities to implement termination procedures including removing system access to prevent unauthorized use of ePHI post-employment.

A healthcare organization uses a cloud-based EHR. Under HIPAA, which type of agreement must be in place with the cloud provider?

Answer: Business Associate Agreement (BAA)

Cloud providers that create, receive, maintain, or transmit ePHI on behalf of a covered entity are business associates and must have a BAA in place.

Under the HIPAA Security Rule, 'audit controls' are best described as:

Answer: Hardware, software, or procedural mechanisms that record and examine activity in systems containing ePHI

Audit controls (45 CFR §164.312(b)) require mechanisms to record and examine access and activity in information systems that contain or use ePHI.

Which of the following encryption standards is generally accepted for protecting ePHI in transit under HIPAA Security Rule guidance?

Answer: TLS 1.2 or higher

NIST and HHS guidance recommend TLS 1.2 or higher for encrypting ePHI in transit, as older protocols have known vulnerabilities.

What is the key difference between the HIPAA Privacy Rule and the HIPAA Security Rule?

Answer: The Privacy Rule covers all PHI in any form; the Security Rule covers only electronic PHI (ePHI)

The Privacy Rule applies to protected health information in all forms (oral, paper, electronic), while the Security Rule specifically addresses electronic PHI (ePHI).