HCISPP Access Control & Identity Management in Healthcare

Question 1

Which access control model is most commonly used in healthcare settings to grant permissions based on a user's job function?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

RBAC assigns access rights based on predefined roles (e.g., physician, nurse, billing staff), making it the most practical and widely adopted model in healthcare environments.

Question 2

Under HIPAA, workforce members should only have access to the minimum amount of PHI necessary to perform their job duties. This principle is known as:

Accepted Answer

Minimum necessary standard

Answer

The HIPAA minimum necessary standard requires covered entities to limit access to PHI to only that which is reasonably necessary to accomplish the intended purpose.

Question 3

A hospital implements a system where clinicians must provide their username, password, and a fingerprint scan before accessing the EHR. This is an example of:

Accepted Answer

Multi-factor authentication

Answer

Multi-factor authentication (MFA) combines three or more authentication factors — in this case, something you know (password), something you have (username), and something you are (fingerprint).

Question 4

When a healthcare employee is transferred to a different department, the security team should immediately review and update their system access. This practice is part of:

Accepted Answer

User provisioning lifecycle management

Answer

User provisioning lifecycle management covers the full lifecycle of a user account including creation, modification (such as role changes), and deprovisioning, ensuring access always reflects current job duties.

Question 5

A healthcare organization uses a single login that allows staff to access multiple applications such as the EHR, billing system, and HR portal without logging in separately to each. This is called:

Accepted Answer

Single Sign-On (SSO)

Answer

Single Sign-On (SSO) enables users to authenticate once and gain access to multiple systems, reducing password fatigue while maintaining centralized access control.

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP - HealthCare Information Security and Privacy Practitioner Practice Test

HCISPP Access Control & Identity Management in Healthcare