Healthcare IT and Security Technologies Flashcards

Which technology provides the strongest protection for ePHI stored on a lost or stolen laptop under HIPAA?

Answer: Full-disk encryption using FIPS 140-2 validated modules

Full-disk encryption using FIPS 140-2 validated cryptographic modules renders data unreadable on a stolen device and qualifies for HIPAA's encryption safe harbor.

In a healthcare EHR environment, which access control model most effectively enforces the Minimum Necessary standard?

Answer: Role-Based Access Control (RBAC)

RBAC restricts ePHI access based on defined job roles, naturally enforcing the Minimum Necessary standard by limiting access to what each role requires.

What is a 'break-the-glass' procedure in the context of healthcare IT?

Answer: An audit-logged override mechanism allowing emergency access to restricted PHI when needed for patient care

Break-the-glass is an emergency access override that allows authorized users to access restricted PHI in urgent clinical situations, with all access fully audit-logged.

Which healthcare interoperability standard defines the format for electronic exchange of clinical data including medications, allergies, and diagnoses?

Answer: HL7 FHIR

HL7 FHIR (Fast Healthcare Interoperability Resources) is the current standard for healthcare data exchange, enabling structured clinical data sharing between systems.

A healthcare organization is evaluating a mobile health (mHealth) app that will access patient ePHI. Under HIPAA, which consideration is MOST critical before deployment?

Answer: Whether the app vendor has signed a BAA and the app uses appropriate encryption and access controls

Before deploying any mHealth app that accesses ePHI, the vendor must execute a BAA and the app must implement appropriate safeguards including encryption and access controls.

Which security control is MOST effective at detecting unauthorized internal access to ePHI by snooping employees?

Answer: User and Entity Behavior Analytics (UEBA)

UEBA establishes behavioral baselines for each user and alerts on anomalous access patterns, making it highly effective at detecting insider threats like snooping.