HCISPP Access Control & Identity Management in Healthcare 3

Question 1

A hospital's security policy requires that users accessing PHI from outside the corporate network use a VPN with certificate-based authentication. This requirement primarily addresses which security objective?

Accepted Answer

Secure remote access and identity verification

Answer

Certificate-based VPN authentication ensures that only verified, authorized users and devices can establish a secure tunnel to access PHI remotely, addressing both identity verification and secure access.

Question 2

Under the HIPAA Security Rule, covered entities must implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. This is specifically addressed by which implementation specification?

Accepted Answer

Person or entity authentication

Answer

The HIPAA Security Rule includes 'person or entity authentication' as a required implementation specification under technical safeguards to ensure that users accessing ePHI are who they claim to be.

Question 3

A healthcare organization discovers that a former contractor's account was still active six months after the contract ended. This indicates a failure in which process?

Accepted Answer

Account deprovisioning in the identity lifecycle

Answer

Account deprovisioning is the process of timely removing or disabling access for users who no longer need it; failure to deprovision leads to orphaned accounts that pose a significant security risk.

Question 4

Which approach allows a healthcare organization to manage access across multiple affiliated hospitals and clinics by recognizing credentials issued by partner institutions?

Accepted Answer

Federated Identity Management

Answer

Federated Identity Management enables multiple organizations to share identity and access credentials, allowing a user authenticated by one organization to access resources at a partner organization without a separate login.

Question 5

A healthcare CISO wants to reduce the risk of credential theft by ensuring that even if a password is stolen, an attacker cannot gain access. The MOST effective control to implement is:

Accepted Answer

Implementing multi-factor authentication (MFA)

Answer

Multi-factor authentication adds an additional verification layer beyond the password, so a stolen password alone is insufficient for an attacker to gain access to the system.

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP Access Control & Identity Management in Healthcare 3