Equipment Operation & Maintenance Flashcards
7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Equipment Operation & Maintenance flashcards as text
Under HIPAA's Device and Media Controls standard (§164.310(d)), what must be tracked in an equipment inventory?
Answer: Hardware and electronic media that contain ePHI, including movement in and out of the facility
The Device and Media Controls standard requires covered entities to maintain records of hardware and electronic media that contain ePHI and track their movement.
A clinical workstation has not received operating system security patches in 18 months due to compatibility concerns with legacy software. Under HIPAA, this situation requires:
Answer: A documented risk analysis and compensating controls to mitigate known vulnerabilities
When patching is not feasible, HIPAA requires a documented risk analysis identifying the risk level and implementation of compensating controls (e.g., network isolation) to reduce risk.
Which of the following BEST describes the HIPAA concept of 'workstation use' as it applies to clinical equipment?
Answer: A policy defining the proper functions and physical surroundings for workstations that access ePHI
The Workstation Use standard (§164.310(b)) requires policies specifying the proper functions and physical attributes of the environment for each class of workstation that accesses ePHI.
An organization reuses hard drives from decommissioned workstations in new machines after formatting them. What HIPAA risk does this practice present?
Answer: Risk of residual ePHI remaining accessible through forensic recovery tools
Standard formatting does not overwrite all sectors; residual ePHI can be recovered with forensic software, making this practice non-compliant without proper sanitization per NIST SP 800-88.
A covered entity's security policy requires encrypting all portable devices. An employee argues that a USB thumb drive used only internally doesn't need encryption. Under HIPAA, this argument is:
Answer: Invalid because portable media containing ePHI must be protected against loss or theft regardless of typical use
HIPAA's Device and Media Controls require protection of all portable media containing ePHI from unauthorized access, including loss or theft, whether used internally or externally.
When a covered entity contracts with a cloud storage provider to back up ePHI from its medical imaging equipment, the provider is considered a:
Answer: Business associate requiring a BAA
A cloud storage provider that maintains ePHI on behalf of a covered entity meets the definition of a business associate and requires a BAA under HIPAA.
Which action is REQUIRED when an employee transfers to a different department and no longer needs access to a specific medical imaging system?
Answer: Promptly terminate or modify the employee's access rights to that system
HIPAA's Access Control standard requires that access be granted based on minimum necessary principles, and access rights must be revoked promptly when no longer needed.