Healthcare Information Security Controls Flashcards

Under the HIPAA Security Rule, which of the following is classified as an 'Addressable' implementation specification?

Answer: Automatic logoff

Automatic logoff is an Addressable specification under the Access Control standard, meaning entities must implement it if reasonable and appropriate or document why an equivalent measure was chosen.

Which HIPAA Security Rule standard requires covered entities to implement policies to prevent, detect, contain, and correct security violations?

Answer: Security Management Process

The Security Management Process standard (45 CFR §164.308(a)(1)) is the overarching standard requiring risk analysis, risk management, sanction policy, and activity review.

What is the primary purpose of a risk analysis under the HIPAA Security Rule?

Answer: To identify and assess threats, vulnerabilities, and risks to ePHI confidentiality, integrity, and availability

A risk analysis identifies and assesses potential threats and vulnerabilities to ePHI to determine the likelihood and impact of security incidents.

Under the HIPAA Security Rule, which safeguard category includes workstation use policies and facility access controls?

Answer: Physical Safeguards

Physical Safeguards govern physical access to facilities and workstations, including facility access controls, workstation use policies, and device and media controls.

A healthcare organization discovers that an employee's workstation has been accessed by an unauthorized user. According to the HIPAA Security Rule, this should be documented under which process?

Answer: Security Incident Procedures

Security Incident Procedures require covered entities to document and respond to suspected or known security incidents, including unauthorized access events.

Which of the following HIPAA Security Rule requirements addresses the need for a covered entity to restore ePHI data after a disaster?

Answer: Disaster Recovery Plan

The Disaster Recovery Plan implementation specification (45 CFR §164.308(a)(7)(ii)(B)) requires procedures to restore lost data in the event of an emergency or disaster.