HIPAA Administrative Safeguards 2

Question 1

Under HIPAA's Administrative Safeguards, what is the primary purpose of a contingency plan?

Accepted Answer

To respond to emergencies that damage systems containing ePHI

Answer

To prevent unauthorized access to ePHI systems

Answer

To train workforce members on PHI handling

Answer

To document business associate agreements

Question 2

Which component of the contingency plan addresses how a covered entity will continue operating in the event of a system failure?

Accepted Answer

Emergency mode operation plan

Answer

Disaster recovery plan

Answer

Data backup plan

Answer

Testing and revision procedure

Question 3

A hospital's security officer discovers that a workforce member accessed patient records without authorization. Under Administrative Safeguards, what must occur?

Accepted Answer

The hospital must apply appropriate sanctions against the workforce member

Answer

The hospital must immediately notify HHS

Answer

The hospital must terminate the workforce member

Answer

The hospital must file a police report

Question 4

What does the 'assigned security responsibility' standard under Administrative Safeguards require?

Accepted Answer

One individual must be identified as responsible for security policies and procedures

Answer

Every workforce member must have a unique security role

Answer

Security responsibilities must be outsourced to a third party

Answer

A security committee must be established

Question 5

Under HIPAA, an authorization and/or supervision implementation specification requires covered entities to:

Accepted Answer

Supervise workforce members who work with ePHI

Answer

Require dual authorization for all ePHI access

Answer

Obtain written authorization from patients before access

Answer

Have all PHI access approved by a privacy officer

Question 6

How often must covered entities review and modify their security policies under HIPAA's Administrative Safeguards?

Accepted Answer

Periodically, based on environmental or operational changes

Answer

Annually, as required by statute

Answer

Every three years, per HHS guidance

Answer

Only when a breach occurs

Question 7

A covered entity uses a clearinghouse to process claims. Under the workforce clearance procedure, what must be done before granting this clearinghouse access to ePHI?

Accepted Answer

Implement procedures to verify authorization of access is appropriate

Answer

Execute a business associate agreement only

Answer

Obtain patient consent for third-party processing

Answer

Require the clearinghouse to carry malpractice insurance