HCISPP Access Control & Identity Management in Healthcare 1 — Questions and Answers
Question 1: Which access control model is most commonly used in healthcare settings to grant permissions based on a user's job function?
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Discretionary Access Control (DAC)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns access rights based on predefined roles (e.g., physician, nurse, billing staff), making it the most practical and widely adopted model in healthcare environments.
Question 2: Under HIPAA, workforce members should only have access to the minimum amount of PHI necessary to perform their job duties. This principle is known as:
- Need-to-know principle
- Minimum necessary standard (Correct answer)
- Least privilege doctrine
- Access transparency rule
Correct answer: Minimum necessary standard
The HIPAA minimum necessary standard requires covered entities to limit access to PHI to only that which is reasonably necessary to accomplish the intended purpose.
Question 3: A hospital implements a system where clinicians must provide their username, password, and a fingerprint scan before accessing the EHR. This is an example of:
- Single-factor authentication
- Two-factor authentication
- Multi-factor authentication (Correct answer)
- Federated authentication
Correct answer: Multi-factor authentication
Multi-factor authentication (MFA) combines three or more authentication factors — in this case, something you know (password), something you have (username), and something you are (fingerprint).
Question 4: When a healthcare employee is transferred to a different department, the security team should immediately review and update their system access. This practice is part of:
- Access recertification
- Privilege escalation management
- User provisioning lifecycle management (Correct answer)
- Identity federation
Correct answer: User provisioning lifecycle management
User provisioning lifecycle management covers the full lifecycle of a user account including creation, modification (such as role changes), and deprovisioning, ensuring access always reflects current job duties.
Question 5: A healthcare organization uses a single login that allows staff to access multiple applications such as the EHR, billing system, and HR portal without logging in separately to each. This is called:
- Multi-factor authentication
- Federated identity management
- Single Sign-On (SSO) (Correct answer)
- Privileged Access Management
Correct answer: Single Sign-On (SSO)
Single Sign-On (SSO) enables users to authenticate once and gain access to multiple systems, reducing password fatigue while maintaining centralized access control.
Question 6: Which of the following BEST describes the principle of 'separation of duties' as applied to healthcare information security?
- Ensuring no single user can perform all critical tasks without oversight (Correct answer)
- Dividing the IT department into separate security and operations teams
- Requiring two clinicians to co-sign every patient record
- Separating PHI databases from administrative databases
Correct answer: Ensuring no single user can perform all critical tasks without oversight
Separation of duties ensures that no single individual can complete a critical or high-risk process alone, reducing the risk of fraud, error, or unauthorized access.
Question 7: An employee whose role requires access to PHI resigns. What is the FIRST action the security team should take regarding their system access?
- Archive all files accessed by the employee
- Disable or revoke the employee's access credentials immediately (Correct answer)
- Transfer the employee's account to their supervisor
- Generate an audit report of all recent access activity
Correct answer: Disable or revoke the employee's access credentials immediately
Immediately disabling or revoking access upon termination is the top priority to prevent unauthorized access to PHI by a departing employee.
HCISPP Access Control & Identity Management in Healthcare 1
Which access control model is most commonly used in healthcare settings to grant permissions based on a user's job function?