Epic Skills Assessment Information Security & HIPAA Compliance 3

Question 1

Which of the following is an administrative safeguard under the HIPAA Security Rule?

Accepted Answer

Conducting regular workforce security training and awareness programs

Answer

Installing firewalls to protect network traffic

Answer

Requiring physical access badges for server rooms

Answer

Encrypting hard drives on all workstations

Question 2

A patient requests that their doctor not share their mental health records with their employer. Under HIPAA, the covered entity must:

Accepted Answer

Honor the restriction request for disclosures the patient pays for out of pocket

Answer

Share the records if the employer provides written justification

Answer

Deny the request because treatment information must always flow freely

Answer

Notify the state health department before restricting access

Question 3

When a user logs into Epic, the system requires both a password and a one-time code sent to their mobile device. This security mechanism is called:

Accepted Answer

Multi-factor authentication (MFA)

Answer

Single sign-on (SSO)

Answer

Role-based access control (RBAC)

Answer

Federated identity management

Question 4

De-identification of PHI under HIPAA's Safe Harbor method requires removing how many specific identifiers?

Accepted Answer

18

Answer

12

Answer

24

Answer

36

Question 5

An employee notices a colleague printing large volumes of patient records and taking them home. The MOST appropriate first action is to:

Accepted Answer

Report the suspicious activity to the privacy or compliance officer

Answer

Confront the colleague directly and demand an explanation

Answer

Ignore the behavior to avoid workplace conflict

Answer

Post about the concern on the hospital's internal message board

Question 6

Which of the following represents the principle of 'data integrity' in the context of ePHI?

Accepted Answer

Ensuring ePHI has not been altered or destroyed in an unauthorized manner

Answer

Ensuring ePHI is accessible only to authorized users

Answer

Ensuring ePHI is available when needed for patient care

Answer

Ensuring ePHI is transmitted quickly and efficiently

Question 7

A healthcare organization's workforce member accidentally emails PHI to the wrong patient. Under HIPAA, this event is BEST classified as:

Accepted Answer

A potential breach requiring risk assessment to determine notification obligations

Answer

A permissible incidental disclosure requiring no further action

Answer

A criminal violation requiring immediate law enforcement notification

Answer

An authorized disclosure under the treatment exception