HIPAA Administrative Safeguards 3

Question 1

Which of the following is an ADDRESSABLE implementation specification under the Security Management Process standard?

Accepted Answer

Information system activity review

Answer

Risk analysis

Answer

Risk management

Answer

Sanction policy

Question 2

A small medical practice decides not to implement an addressable specification. What must they do?

Accepted Answer

Document the reason and implement an equivalent alternative if reasonable

Answer

Notify HHS of the decision within 30 days

Answer

Obtain a waiver from their regional HHS office

Answer

Have the decision approved by their privacy officer

Question 3

What is the scope of HIPAA's workforce training requirement under Administrative Safeguards?

Accepted Answer

All workforce members, including volunteers and trainees

Answer

Only workforce members who directly handle ePHI

Answer

Only IT staff responsible for ePHI systems

Answer

Workforce members hired after the compliance date

Question 4

Under the Security Management Process, what is the purpose of 'information system activity review'?

Accepted Answer

To audit logs, access reports, and security incident tracking reports

Answer

To certify that all ePHI systems meet NIST standards

Answer

To review system uptime and performance metrics

Answer

To assess vendor compliance with BAAs

Question 5

A covered entity undergoes a merger. Which Administrative Safeguard process must be updated to reflect the new organizational structure?

Accepted Answer

Security policies and procedures, including risk analysis

Answer

Only the contingency plan

Answer

Only workforce training

Answer

Only the assigned security responsibility designation

Question 6

Which of the following best describes the 'termination procedures' implementation specification under workforce security?

Accepted Answer

Procedures for revoking access to ePHI when employment ends

Answer

Steps to fire noncompliant workforce members

Answer

Guidelines for employee exit interviews about PHI

Answer

Policies for reassigning ePHI access after termination

Question 7

A HIPAA-covered entity's security training includes reminders about malicious software. This training element maps to which implementation specification?

Accepted Answer

Protection from malicious software

Answer

Log-in monitoring

Answer

Password management

Answer

Security reminders