CHPC PHI Safeguards and Security Questions and Answers

Question 1

A healthcare clinic is relocating to a new facility, and its IT department is moving servers and backup tapes containing ePHI.
According to the HIPAA Security Rule's Physical Safeguards, which of the following is a key requirement for managing this process?

Accepted Answer

Maintaining a record of the movement of the hardware and electronic media.

Answer

Encrypting all data on the servers and tapes prior to the move.

Answer

Notifying all patients of the clinic's change of address and potential data risk.

Answer

Performing a full risk analysis of the new facility's network infrastructure before connecting devices.

Question 2

A hospital's electronic health record (EHR) system experiences a network outage, preventing clinicians from using their standard credentials. To ensure patient care continues, the organization must have a pre-established method for accessing necessary ePHI. Which HIPAA Security Rule standard specifically addresses this requirement?

Accepted Answer

Emergency Access Procedure

Answer

Unique User Identification

Answer

Audit Controls

Answer

Automatic Logoff

Question 3

A Privacy Officer is reviewing the organization's HIPAA Security Rule contingency plan to ensure all required components are present. Which of the following collections of plans MUST be included?

Accepted Answer

A data backup plan, a disaster recovery plan, and an emergency mode operation plan.

Answer

A security incident response plan, a breach notification plan, and a workforce sanction plan.

Answer

A facility security plan, a workstation use policy, and a device and media control plan.

Answer

An access control plan, an audit control plan, and a transmission security plan.

Question 4

A hospital's janitorial staff discards unshredded patient documents containing names, diagnoses, and account numbers into a publicly accessible dumpster. This event constitutes a breach. Which specific safeguard failure is MOST directly responsible for this type of incident?

Accepted Answer

Failure to implement proper policies for the final disposition of PHI.

Answer

Failure of technical access controls on the electronic health record system.

Answer

Failure of the organization's disaster recovery plan.

Answer

Failure to obtain patient authorization for research purposes.

Question 5

A covered entity is drafting a Business Associate Agreement (BAA) with a new cloud storage vendor. According to HIPAA, which of the following is a mandatory provision that the BAA must contain regarding the business associate's duties?

Accepted Answer

The business associate must implement appropriate administrative, physical, and technical safeguards.

Answer

The business associate must use the same brand of firewall and antivirus software as the covered entity.

Answer

The business associate must conduct a penetration test annually and provide the full report to the covered entity.

Answer

The business associate must ensure all its employees complete the covered entity's specific HIPAA training module.

Question 6

An employee at a physician's office is found to have accessed the medical record of a coworker out of curiosity, with no legitimate job-related reason. This is a clear violation of the organization's privacy policy. Which HIPAA Administrative Safeguard requires the organization to have a formal policy for addressing this employee's misconduct?

Accepted Answer

Sanction Policy

Answer

Information Access Management

Answer

Security Awareness and Training

Answer

Security Incident Procedures