Risk Analysis and Risk Management Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Analysis and Risk Management flashcards as text
After completing a risk analysis, how should a covered entity generally prioritize remediation in its risk management plan?
Answer: Address the highest-rated risks first
Risk management should prioritize measures based on the risk levels assigned during the analysis.
Which Security Rule standard requires identifying one person responsible for developing and implementing security policies and procedures?
Answer: Assigned security responsibility
164.308(a)(2) requires designating a security official responsible for Security Rule policies and procedures.
The information system activity review specification requires regular review of which records?
Answer: Audit logs, access reports, and security incident tracking reports
Under 164.308(a)(1)(ii)(D), entities must regularly review system activity records such as audit logs and access reports.
A nurse repeatedly accesses records of patients not under her care. Which Security Management Process specification requires the hospital to have a policy for responding?
Answer: Sanction policy
The sanction policy requires appropriate sanctions against workforce members who fail to comply with security policies.
A hospital migrates to a new EHR system hosted by a different vendor. What should it do regarding its risk analysis?
Answer: Update the risk analysis to address new risks introduced by the change
Significant operational or technology changes should trigger a review and update of the risk analysis.
Is the risk analysis implementation specification under the HIPAA Security Rule 'required' or 'addressable'?
Answer: Required for all covered entities and business associates
Risk analysis is a required implementation specification with no addressable alternative.
Why does OCR caution that a 'gap analysis' is typically not sufficient to satisfy the risk analysis requirement?
Answer: A gap analysis usually reviews existing controls against requirements but does not assess the likelihood and impact of risks to all ePHI
OCR states a gap analysis is a partial review and does not meet the enterprise-wide risk assessment requirement.