CSC HIPAA Security Rule 2

Question 1

Under the HIPAA Security Rule, which type of safeguard specifically addresses workforce training and security awareness programs?

Accepted Answer

Administrative safeguards

Answer

Technical safeguards

Answer

Physical safeguards

Answer

Operational safeguards

Question 2

A covered entity discovers a workforce member has been accessing patient records outside their job role for three months. Which HIPAA Security Rule standard is most directly implicated?

Accepted Answer

Information Access Management

Answer

Access Control

Answer

Audit Controls

Answer

Workforce Clearance Procedure

Question 3

What does the HIPAA Security Rule require regarding the transmission of ePHI over open networks?

Accepted Answer

Encryption or equivalent measures must protect ePHI in transit

Answer

ePHI must never be transmitted over open networks

Answer

A business associate agreement must accompany every transmission

Answer

Transmission logs must be reviewed daily

Question 4

Which of the following is an example of a physical safeguard under the HIPAA Security Rule?

Accepted Answer

Facility access controls with badge readers

Answer

Automatic logoff after inactivity

Answer

Encryption of ePHI at rest

Answer

Workstation use policies

Question 5

The HIPAA Security Rule's 'minimum necessary' concept most directly applies to which safeguard category?

Accepted Answer

Administrative safeguards via access management

Answer

Technical safeguards via encryption

Answer

Physical safeguards via workstation controls

Answer

Audit controls via log retention

Question 6

A hospital's contingency plan fails during a ransomware attack because backups were also encrypted. Which required implementation specification was inadequately addressed?

Accepted Answer

Data Backup Plan

Answer

Disaster Recovery Plan

Answer

Emergency Mode Operation Plan

Answer

Testing and Revision Procedures

Question 7

Under HIPAA Security Rule, how often must covered entities review and modify their security policies and procedures?

Accepted Answer

Periodically, in response to environmental or operational changes

Answer

Annually, regardless of changes

Answer

Every three years as part of a formal audit cycle

Answer

Only when a breach occurs