CHP Documentation & Record Keeping 3

Question 1

Under the HIPAA Security Rule, how long must covered entities retain security-related documentation?

Accepted Answer

6 years from creation or last effective date

Answer

The HIPAA Security Rule requires that security policies, procedures, and related documentation be retained for 6 years from the date of creation or the date it was last in effect.

Question 2

What must be included in a covered entity's documentation of its risk analysis?

Accepted Answer

The scope, identified threats and vulnerabilities, current controls, likelihood, and impact assessments

Answer

A thorough risk analysis must document the scope of the analysis, potential threats and vulnerabilities, existing security controls, and the likelihood and impact of potential risks to ePHI.

Question 3

An organization updates its password policy. What documentation action is required under HIPAA?

Accepted Answer

The new policy must be documented and the prior version retained for 6 years

Answer

Any changes to HIPAA-required policies must be documented, and prior versions must also be retained for the required 6-year period from when they were last in effect.

Question 4

Which of the following is an example of required Security Rule documentation?

Accepted Answer

Facility access logs and audit trails for ePHI systems

Answer

The Security Rule requires documentation of audit logs, access controls, and other safeguards implemented to protect ePHI from unauthorized access.

Question 5

A small physician practice stores its HIPAA documentation on paper. Is this compliant?

Accepted Answer

Yes, HIPAA documentation may be maintained in written or electronic form

Answer

HIPAA does not mandate a specific format for documentation and permits covered entities to maintain required records in either written or electronic form.

(CHP) Certified HIPAA Professional Practice Test

(CHP) Certified HIPAA Professional Practice Test

CHP Documentation & Record Keeping 3