Access Control & Identity Management in Healthcare Flashcards

A hospital's security policy requires that users accessing PHI from outside the corporate network use a VPN with certificate-based authentication. This requirement primarily addresses which security objective?

Answer: Secure remote access and identity verification

Certificate-based VPN authentication ensures that only verified, authorized users and devices can establish a secure tunnel to access PHI remotely, addressing both identity verification and secure access.

Under the HIPAA Security Rule, covered entities must implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. This is specifically addressed by which implementation specification?

Answer: Person or entity authentication

The HIPAA Security Rule includes 'person or entity authentication' as a required implementation specification under technical safeguards to ensure that users accessing ePHI are who they claim to be.

A healthcare organization discovers that a former contractor's account was still active six months after the contract ended. This indicates a failure in which process?

Answer: Account deprovisioning in the identity lifecycle

Account deprovisioning is the process of timely removing or disabling access for users who no longer need it; failure to deprovision leads to orphaned accounts that pose a significant security risk.

Which approach allows a healthcare organization to manage access across multiple affiliated hospitals and clinics by recognizing credentials issued by partner institutions?

Answer: Federated Identity Management

Federated Identity Management enables multiple organizations to share identity and access credentials, allowing a user authenticated by one organization to access resources at a partner organization without a separate login.

A healthcare CISO wants to reduce the risk of credential theft by ensuring that even if a password is stolen, an attacker cannot gain access. The MOST effective control to implement is:

Answer: Implementing multi-factor authentication (MFA)

Multi-factor authentication adds an additional verification layer beyond the password, so a stolen password alone is insufficient for an attacker to gain access to the system.

A healthcare organization is implementing a new EHR system and must decide how to structure user permissions. Which approach aligns BEST with both the HIPAA minimum necessary standard and the principle of least privilege?

Answer: Define granular roles aligned to job functions and assign only required permissions to each role

Defining granular, job-function-aligned roles and assigning only required permissions to each ensures compliance with both the HIPAA minimum necessary standard and the security principle of least privilege.

In healthcare identity management, 'just-in-time (JIT) provisioning' refers to:

Answer: Automatically creating a user account in a target system the first time the user attempts to log in via SSO

Just-in-time provisioning automatically creates a user account in a target application the moment the user first authenticates via an identity provider (such as SSO), eliminating the need for pre-created accounts in every system.