Healthcare Information Security Controls Flashcards

Under the HIPAA Security Rule, what is the purpose of the 'Assigned Security Responsibility' standard?

Answer: Designating a person responsible for developing and implementing security policies and procedures

The Assigned Security Responsibility standard (45 CFR §164.308(a)(2)) requires covered entities to identify a Security Officer responsible for security policies and procedures.

A hospital's EHR system sends a patient summary to a referring physician via unsecured email. Under the HIPAA Security Rule, which standard is most directly violated?

Answer: Transmission Security

Transmission Security (45 CFR §164.312(e)) requires covered entities to guard against unauthorized access to ePHI transmitted over electronic communications networks.

Which HIPAA Security Rule safeguard category includes the requirement for workforce training on security policies and procedures?

Answer: Administrative Safeguards

Security Awareness and Training is an Administrative Safeguard (45 CFR §164.308(a)(5)) requiring periodic security training for all workforce members.

Under NIST guidelines adopted for HIPAA compliance, what does the acronym 'FIPS' stand for?

Answer: Federal Information Processing Standards

FIPS stands for Federal Information Processing Standards, which are NIST-issued standards often referenced in HIPAA security guidance, particularly for encryption.

A covered entity's risk management plan should achieve which primary goal per the HIPAA Security Rule?

Answer: Reduce risks to ePHI to a reasonable and appropriate level

Risk management under the Security Rule aims to reduce risks and vulnerabilities to ePHI to a reasonable and appropriate level — not necessarily eliminate them entirely.

Which of the following is an example of a technical safeguard under the HIPAA Security Rule?

Answer: Role-based access control limiting ePHI access by job function

Role-based access control is a technical safeguard — it uses technology to ensure workforce members access only the ePHI necessary for their job functions.