Healthcare IT and Security Technologies Flashcards

A healthcare organization's security team detects unusual after-hours access to the EHR from a nurse's account. Which NIST Incident Response phase should they initiate FIRST?

Answer: Containment

Upon detecting a potential incident, the immediate priority is Containment to prevent further unauthorized access while the team assesses the scope of the incident.

Which type of malware specifically encrypts healthcare data and demands payment for decryption keys, causing significant operational disruption to hospitals?

Answer: Ransomware

Ransomware encrypts files or systems and demands ransom payment for decryption, making it particularly devastating in healthcare where data availability is critical to patient care.

In healthcare security, what is the primary purpose of a 'penetration test'?

Answer: Simulating real-world attacks to identify exploitable vulnerabilities before malicious actors do

Penetration testing uses ethical hackers to simulate real attacks against healthcare systems, identifying exploitable vulnerabilities that automated scans may miss.

Under HIPAA Security Rule requirements, what is the primary purpose of maintaining system activity review (audit log review)?

Answer: To detect inappropriate or unauthorized access to ePHI and security incidents

Regular audit log review enables covered entities to detect unauthorized or inappropriate access to ePHI, which is central to the Security Management Process requirements.

Which of the following best describes a 'zero trust' security model in the context of healthcare IT?

Answer: Requiring continuous verification of every user, device, and connection regardless of network location

Zero trust operates on the principle of 'never trust, always verify' — every access request is authenticated and authorized regardless of network origin.

A healthcare organization discovers that its EHR vendor suffered a cyberattack that exposed ePHI. Under HIPAA, the FIRST step the covered entity should take is:

Answer: Confirm the scope of the incident with the vendor and obtain details to conduct its own HIPAA breach risk assessment

Before taking any notification actions, the covered entity must gather information from the vendor to conduct its own four-factor risk assessment to determine whether a reportable breach occurred.