Access Control & Identity Management in Healthcare Flashcards

Which access control model is most commonly used in healthcare settings to grant permissions based on a user's job function?

Answer: Role-Based Access Control (RBAC)

RBAC assigns access rights based on predefined roles (e.g., physician, nurse, billing staff), making it the most practical and widely adopted model in healthcare environments.

Under HIPAA, workforce members should only have access to the minimum amount of PHI necessary to perform their job duties. This principle is known as:

Answer: Minimum necessary standard

The HIPAA minimum necessary standard requires covered entities to limit access to PHI to only that which is reasonably necessary to accomplish the intended purpose.

A hospital implements a system where clinicians must provide their username, password, and a fingerprint scan before accessing the EHR. This is an example of:

Answer: Multi-factor authentication

Multi-factor authentication (MFA) combines three or more authentication factors — in this case, something you know (password), something you have (username), and something you are (fingerprint).

When a healthcare employee is transferred to a different department, the security team should immediately review and update their system access. This practice is part of:

Answer: User provisioning lifecycle management

User provisioning lifecycle management covers the full lifecycle of a user account including creation, modification (such as role changes), and deprovisioning, ensuring access always reflects current job duties.

A healthcare organization uses a single login that allows staff to access multiple applications such as the EHR, billing system, and HR portal without logging in separately to each. This is called:

Answer: Single Sign-On (SSO)

Single Sign-On (SSO) enables users to authenticate once and gain access to multiple systems, reducing password fatigue while maintaining centralized access control.

Which of the following BEST describes the principle of 'separation of duties' as applied to healthcare information security?

Answer: Ensuring no single user can perform all critical tasks without oversight

Separation of duties ensures that no single individual can complete a critical or high-risk process alone, reducing the risk of fraud, error, or unauthorized access.

An employee whose role requires access to PHI resigns. What is the FIRST action the security team should take regarding their system access?

Answer: Disable or revoke the employee's access credentials immediately

Immediately disabling or revoking access upon termination is the top priority to prevent unauthorized access to PHI by a departing employee.