CHPS HIPAA Security Rule Compliance

Question 1

The HIPAA Security Rule organizes its standards into three categories of safeguards. Which of the following correctly lists all three?

Accepted Answer

Administrative, Physical, and Technical

Answer

Administrative, Operational, and Technical

Answer

Organizational, Physical, and Logical

Answer

Policy, Physical, and Procedural

Question 2

Under the HIPAA Security Rule, what distinguishes a 'required' implementation specification from an 'addressable' one?

Accepted Answer

Required specifications must be implemented as stated; addressable ones must be implemented, modified, or documented as not applicable with justification

Answer

Required specifications apply only to hospitals; addressable ones apply to all covered entities

Answer

Required specifications are technical controls; addressable ones are administrative controls

Answer

Required specifications must be audited annually; addressable ones are optional

Question 3

The HIPAA Security Rule specifically protects which type of protected health information (PHI)?

Accepted Answer

Electronic protected health information (ePHI) only

Answer

Paper and electronic protected health information

Answer

Verbal and electronic protected health information

Answer

All forms of PHI including oral, paper, and electronic

Question 4

Which entities are directly required to comply with the HIPAA Security Rule?

Accepted Answer

Covered entities and business associates

Answer

Covered entities only

Answer

Business associates only

Answer

All entities that handle any patient data

Question 5

What is the primary purpose of conducting a Security Risk Analysis (SRA) under the HIPAA Security Rule?

Accepted Answer

To identify and assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI

Answer

To document all breaches that have occurred in the past year

Answer

To certify that all technical safeguards are functioning properly

Answer

To train workforce members on security policies

Question 6

Under the Administrative Safeguards of the HIPAA Security Rule, which standard requires covered entities to implement policies and procedures to prevent, detect, contain, and correct security violations?

Accepted Answer

Security Incident Procedures

Answer

Information Access Management

Answer

Workforce Security

Answer

Security Awareness and Training

Question 7

How frequently must a covered entity review and update its security policies and procedures under the HIPAA Security Rule?

Accepted Answer

Periodically, and in response to environmental or operational changes that affect ePHI security

Answer

Annually on a fixed calendar schedule

Answer

Only when a breach or security incident occurs

Answer

Every three years as part of a formal certification cycle