Epic Skills Assessment Information Security & HIPAA Compliance 2

Question 1

Which of the following best describes the concept of 'role-based access control' in an EHR system like Epic?

Accepted Answer

Access privileges are granted based on a user's job function and responsibilities

Answer

Users can access any record they need by requesting temporary permission

Answer

All clinical staff have equal access to all patient records system-wide

Answer

Access is determined solely by the patient's consent preferences

Question 2

A third-party vendor needs access to a hospital's Epic environment to perform system maintenance. What must be in place before this access is granted?

Accepted Answer

A signed Business Associate Agreement (BAA)

Answer

A signed Notice of Privacy Practices

Answer

An individual HIPAA waiver from each patient

Answer

Approval from the state health department

Question 3

Which of the following is the MOST effective way to protect ePHI transmitted over a public network?

Accepted Answer

Encrypting the data before transmission

Answer

Using a strong password on the sending workstation

Answer

Sending data in small batches to reduce exposure

Answer

Requiring the recipient to acknowledge receipt

Question 4

An employee receives an email that appears to be from Epic Systems requesting their login credentials to 'verify their account.' This is most likely:

Accepted Answer

A phishing attack attempting to steal credentials

Answer

A legitimate security audit by the IT department

Answer

A standard password reset notification

Answer

An authorized penetration testing exercise

Question 5

Under HIPAA, which category of health information can be freely used and shared without patient authorization?

Accepted Answer

PHI shared for treatment, payment, and healthcare operations (TPO)

Answer

PHI shared for marketing campaigns by covered entities

Answer

PHI sold to data analytics companies for research

Answer

PHI disclosed to employers for workplace safety decisions

Question 6

What is the purpose of an audit log in an Epic system?

Accepted Answer

To track and record all user activity for accountability and security review

Answer

To automatically correct errors in patient records

Answer

To generate reports for insurance billing purposes

Answer

To back up patient data in case of a system failure

Question 7

Which of the following scenarios would most likely require reporting to the Office for Civil Rights (OCR)?

Accepted Answer

A laptop containing unencrypted PHI for 600 patients is stolen

Answer

A nurse accidentally views the wrong patient's allergies before self-correcting

Answer

A physician discusses a patient's condition with a consulting specialist

Answer

A patient requests a copy of their own medical record