Healthcare IT and Security Technologies Flashcards

Under the 21st Century Cures Act, covered entities and health IT developers must support patient access to health data through which technical standard?

Answer: HL7 FHIR R4 APIs

The 21st Century Cures Act requires certified health IT to support FHIR R4-based APIs enabling patients and authorized third parties to access their health data.

What is the primary security concern with healthcare Internet of Medical Things (IoMT) devices?

Answer: They often run legacy operating systems with limited patching capabilities, creating unmanageable vulnerabilities

IoMT devices often run outdated embedded OS firmware that cannot be patched, creating persistent vulnerabilities that are difficult to remediate in a clinical environment.

Which network segmentation strategy BEST protects a healthcare organization's clinical systems from a ransomware attack originating on the administrative network?

Answer: Segmenting clinical systems into a separate VLAN with strict firewall rules controlling inter-segment traffic

Network segmentation isolates clinical systems from administrative networks, containing ransomware spread and protecting patient-facing systems from attacks originating elsewhere.

In healthcare cybersecurity, what does the term 'patch management' refer to?

Answer: The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities

Patch management is the structured process of keeping software current with security and functional updates to remediate known vulnerabilities before they are exploited.

A healthcare organization is implementing Multi-Factor Authentication (MFA) for EHR access. Which combination provides the strongest authentication?

Answer: Password plus a time-based one-time passcode (TOTP) from an authenticator app

Combining something you know (password) with something you have (TOTP from an authenticator app) provides true multi-factor authentication using distinct factor categories.

Under the HIPAA Security Rule, which of the following best describes the purpose of 'entity authentication'?

Answer: Verifying that a person or entity seeking access to ePHI is who they claim to be before granting access

Entity authentication (45 CFR §164.312(d)) requires covered entities to verify the identity of any person or entity seeking access to ePHI before granting access.