Regulatory and Standards Environment Flashcards

A healthcare organization is conducting a risk analysis as part of its security management process. According to the HIPAA Security Rule, which of the following safeguard categories would this activity primarily fall under?

Answer: Administrative Safeguards

The HIPAA Security Rule categorizes safeguards into three types: Administrative, Physical, and Technical. The Security Management Process, which includes conducting a risk analysis, is a core requirement of the Administrative Safeguards. These safeguards are the policies, procedures, and actions to manage the selection, development, implementation, and maintenance of security measures to protect ePHI.

A U.S.-based employer with 50 employees is concerned about potential discrimination lawsuits. Which federal law prohibits this employer from using an individual's family medical history to make decisions about hiring, firing, or promotion?

Answer: Genetic Information Nondiscrimination Act (GINA)

The Genetic Information Nondiscrimination Act (GINA) of 2008 is a federal law that protects individuals from genetic discrimination in health insurance and employment. Title II of GINA specifically prohibits employers from using genetic information, which includes family medical history, in making employment decisions. GINA's employment protections apply to employers with 15 or more employees.

The HITECH Act was enacted to promote the adoption and meaningful use of health information technology. What was the primary mechanism used by the HITECH Act to encourage providers to adopt certified Electronic Health Record (EHR) technology?

Answer: Financial incentives for early adoption and penalties for non-adoption

The HITECH Act established financial incentive programs under Medicare and Medicaid to encourage eligible professionals and hospitals to adopt and demonstrate "meaningful use" of certified EHRs. Providers who adopted the technology early received payments, while those who did not adopt EHRs by a certain deadline were subject to reduced Medicare payments.

A hospital is implementing the NIST Risk Management Framework (RMF) to strengthen its cybersecurity posture. In which step of the RMF would the hospital classify its information systems based on the potential impact of a loss of confidentiality, integrity, and availability?

Answer: Categorize

The second step of the NIST Risk Management Framework (RMF) is 'Categorize'. In this step, the organization categorizes the information and systems based on an impact analysis, considering the potential adverse effects on organizational operations, assets, and individuals if information security is compromised.

Which international standard provides specific guidance and best practices for information security management within a healthcare context, acting as a sector-specific extension to the ISO/IEC 27002 standard?

Answer: ISO 27799

ISO 27799 provides guidelines for organizational information security standards and information security management practices in health informatics. It serves as a healthcare-specific implementation guide for the controls listed in ISO/IEC 27002 and is intended to be used in conjunction with ISO/IEC 27001.

A medical device manufacturer wants to have its new networked infusion pump certified to an international standard that provides a framework for evaluating IT product security. The evaluation involves defining a Protection Profile (PP) and an Evaluation Assurance Level (EAL). Which standard is being described?

Answer: Common Criteria (ISO/IEC 15408)

The Common Criteria for Information Technology Security Evaluation (recognized as ISO/IEC 15408) is an international standard for computer security certification. Its framework involves users specifying security requirements in a Protection Profile (PP), vendors making claims about their product's security in a Security Target (ST), and labs evaluating the product against an Evaluation Assurance Level (EAL).