Epic Skills Assessment Information Security & HIPAA Compliance 2

Question 1

Which of the following best describes the concept of 'role-based access control' in an EHR system like Epic?

Accepted Answer

Access privileges are granted based on a user's job function and responsibilities

Answer

Role-based access control (RBAC) grants permissions based on the user's organizational role, ensuring staff only access information relevant to their duties.

Question 2

A third-party vendor needs access to a hospital's Epic environment to perform system maintenance. What must be in place before this access is granted?

Accepted Answer

A signed Business Associate Agreement (BAA)

Answer

A Business Associate Agreement (BAA) is legally required between a covered entity and any vendor (business associate) who may access PHI.

Question 3

Which of the following is the MOST effective way to protect ePHI transmitted over a public network?

Accepted Answer

Encrypting the data before transmission

Answer

Encryption renders ePHI unreadable during transmission, so even if intercepted, the data cannot be understood without the decryption key.

Question 4

An employee receives an email that appears to be from Epic Systems requesting their login credentials to 'verify their account.' This is most likely:

Accepted Answer

A phishing attack attempting to steal credentials

Answer

Legitimate organizations never request credentials via email; this is a classic phishing tactic designed to steal login information.

Question 5

Under HIPAA, which category of health information can be freely used and shared without patient authorization?

Accepted Answer

PHI shared for treatment, payment, and healthcare operations (TPO)

Answer

HIPAA permits covered entities to use and disclose PHI without patient authorization specifically for treatment, payment, and healthcare operations purposes.

Epic Skills Assessment Practice Test

Epic Skills Assessment Practice Test

Epic Skills Assessment Information Security & HIPAA Compliance 2