HCISPP Access Control & Identity Management in Healthcare 2

Question 1

A covered entity wants to ensure that only authorized users access PHI stored in its EHR system. Which technical safeguard required by the HIPAA Security Rule DIRECTLY addresses this?

Accepted Answer

Unique user identification

Answer

The HIPAA Security Rule's unique user identification requirement mandates that each user be assigned a unique identifier so that access to PHI can be tracked and attributed to a specific individual.

Question 2

In a healthcare context, 'privileged access' typically refers to:

Accepted Answer

Elevated system or administrative rights granted to IT staff or database administrators

Answer

Privileged access refers to elevated permissions that allow users such as system administrators or DBAs to manage, configure, or modify IT systems, which requires stricter controls and monitoring.

Question 3

A healthcare organization conducts quarterly reviews to ensure that access permissions for all users remain appropriate for their current roles. This process is known as:

Accepted Answer

Access recertification or access review

Answer

Access recertification (or access review) is a periodic process in which managers validate that each user's current access rights are still appropriate for their role, reducing accumulation of unnecessary privileges.

Question 4

A nurse logs into a shared workstation using her credentials and then walks away without logging out. A colleague then views a patient record under her session. Which control would BEST prevent this scenario?

Accepted Answer

Implementing automatic session timeout and screen lock

Answer

Automatic session timeout and screen lock ensures that an unattended session is secured after a period of inactivity, preventing unauthorized access via another person's open session.

Question 5

Which identity management concept involves verifying that a person is who they claim to be before granting them a digital credential or account in a healthcare system?

Accepted Answer

Identity proofing

Answer

Identity proofing is the process of verifying an individual's claimed identity (e.g., checking government ID or employment records) before issuing a digital credential or system account.

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP Access Control & Identity Management in Healthcare 2