HIPAA Administrative Safeguards 4

Question 1

What is the required minimum content of a HIPAA Security Risk Analysis?

Accepted Answer

An accurate and thorough assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability

Answer

A list of all known breaches in the past three years

Answer

A penetration test of all ePHI systems conducted by an external auditor

Answer

A comparison of current security controls against NIST SP 800-53

Question 2

Under HIPAA Administrative Safeguards, 'log-in monitoring' is classified as:

Accepted Answer

An addressable implementation specification under security awareness and training

Answer

A required standard

Answer

A required implementation specification under access control

Answer

An addressable standard under security management process

Question 3

A covered entity conducts a risk assessment and identifies that unencrypted laptops pose a significant risk to ePHI. The entity decides not to encrypt them due to cost. This decision is:

Accepted Answer

Not acceptable because risk management must address identified risks

Answer

Acceptable if documented with a cost justification

Answer

Acceptable if the entity notifies HHS within 60 days

Answer

Acceptable because encryption is only an addressable specification

Question 4

Which HIPAA standard requires covered entities to document the rationale for security policy decisions?

Accepted Answer

Documentation standard

Answer

Security management process

Answer

Assigned security responsibility

Answer

Evaluation standard

Question 5

An evaluation under HIPAA's Administrative Safeguards must be performed:

Accepted Answer

Periodically and in response to environmental or operational changes

Answer

Annually by a certified third-party auditor

Answer

Only after a reported security incident

Answer

Every two years as mandated by the HITECH Act

Question 6

A cloud vendor stores ePHI on behalf of a hospital. Under Administrative Safeguards, this vendor must be treated as:

Accepted Answer

A business associate requiring a signed BAA

Answer

A covered entity subject to all HIPAA rules

Answer

A workforce member subject to sanction policies

Answer

An exempt third party if data is encrypted in transit

Question 7

Which of the following is NOT a required implementation specification under the Contingency Plan standard?

Accepted Answer

Intrusion detection procedure

Answer

Data backup plan

Answer

Disaster recovery plan

Answer

Emergency mode operation plan