CHP Administrative, Physical & Technical Safeguards 3 — Questions and Answers
Question 1: Which of the following best describes a physical safeguard under the HIPAA Security Rule?
- An audit log that tracks who accessed ePHI
- A policy requiring employees to change passwords every 90 days
- A locked server room with keycard access (Correct answer)
- An automatic session timeout on workstations
Correct answer: A locked server room with keycard access
Physical safeguards are physical measures to protect electronic information systems and related buildings from unauthorized access, such as locked server rooms with keycard entry.
Question 2: Under the HIPAA Security Rule's facility access controls standard, which of the following is an addressable implementation specification?
- Contingency operations
- Facility security plan
- Access control and validation procedures
- All of the above (Correct answer)
Correct answer: All of the above
Contingency operations, facility security plan, and access control and validation procedures are all addressable implementation specifications under the facility access controls standard.
Question 3: A clinic uses mobile workstations that move between patient rooms. Which HIPAA physical safeguard standard is most relevant to securing these devices?
- Facility access controls
- Workstation use
- Workstation security (Correct answer)
- Device and media controls
Correct answer: Workstation security
Workstation security requires physical safeguards for workstations that access ePHI, such as positioning screens away from public view and securing mobile units.
Question 4: When a covered entity disposes of a hard drive containing ePHI, which HIPAA standard governs this activity?
- Workstation use
- Device and media controls (Correct answer)
- Facility access controls
- Technical access controls
Correct answer: Device and media controls
Device and media controls require covered entities to implement policies for the final disposition of ePHI and the hardware or media on which it is stored.
Question 5: A healthcare organization plans to relocate its data center. Under HIPAA physical safeguards, which process must be documented?
- Workforce training records for the move
- Accountability tracking of hardware and media movement (Correct answer)
- Insurance coverage for the equipment
- Vendor contracts for relocation services
Correct answer: Accountability tracking of hardware and media movement
Device and media controls require accountability records that track movements of hardware and electronic media containing ePHI.
Question 6: Which of the following is a required (not addressable) implementation specification under the HIPAA workstation use standard?
- Screen lock policies
- Physical barriers around workstations
- Policies specifying proper functions of workstations and how they are used (Correct answer)
- Encryption of workstation hard drives
Correct answer: Policies specifying proper functions of workstations and how they are used
The workstation use standard requires covered entities to document the functions workstations perform and the manner in which those functions are performed — this is a required specification.
Question 7: A visitor enters a hospital's health information management department and views ePHI on an unattended screen. Which physical safeguard failure does this represent?
- Failure of workstation security measures (Correct answer)
- Failure of facility access controls
- Failure of device and media controls
- Failure of contingency operations
Correct answer: Failure of workstation security measures
Workstation security requires physical safeguards to restrict access to authorized users, including positioning screens to prevent unauthorized viewing.
CHP Administrative, Physical & Technical Safeguards 3
Which of the following best describes a physical safeguard under the HIPAA Security Rule?