Epic Skills Assessment Information Security & HIPAA Compliance

Question 1

Under HIPAA, which of the following is considered Protected Health Information (PHI)?

Accepted Answer

A patient's name combined with their diagnosis

Answer

A general description of a medical condition with no patient identifiers

Answer

Aggregate statistics from de-identified patient data

Answer

A physician's personal contact information

Question 2

Which HIPAA rule specifically governs the security of electronic protected health information (ePHI)?

Accepted Answer

The Security Rule

Answer

The Privacy Rule

Answer

The Breach Notification Rule

Answer

The Enforcement Rule

Question 3

An Epic user shares their login credentials with a colleague covering their shift. This is a violation of which security principle?

Accepted Answer

Accountability and non-repudiation

Answer

Data minimization

Answer

Role-based access control

Answer

Encryption standards

Question 4

A hospital employee accesses the medical record of a celebrity patient out of curiosity, without clinical need. This is best described as a violation of:

Accepted Answer

The minimum necessary standard

Answer

Break-the-glass access protocol

Answer

Business associate agreement requirements

Answer

The HITECH Act's audit controls

Question 5

Which of the following is an example of a physical safeguard required by the HIPAA Security Rule?

Accepted Answer

Workstation screens positioned to prevent unauthorized viewing

Answer

Automatic logoff after a period of inactivity

Answer

Encryption of ePHI during transmission

Answer

Audit logs of access to patient records

Question 6

Under HIPAA's Breach Notification Rule, covered entities must notify affected individuals of a PHI breach within how many days?

Accepted Answer

60 days

Answer

30 days

Answer

45 days

Answer

90 days

Question 7

In Epic, 'break-the-glass' access is designed to:

Accepted Answer

Permit authorized users to access records outside their normal permissions when clinically necessary

Answer

Allow administrators to reset user passwords in emergency situations

Answer

Automatically log out users who leave workstations unattended

Answer

Enable bulk data exports for research purposes