HIPAA Administrative Safeguards 4

Question 1

What is the required minimum content of a HIPAA Security Risk Analysis?

Accepted Answer

An accurate and thorough assessment of potential risks and vulnerabilities to ePHI confidentiality, integrity, and availability

Answer

The risk analysis must be an accurate and thorough assessment of potential risks and vulnerabilities to all ePHI that an organization creates, receives, maintains, or transmits.

Question 2

Under HIPAA Administrative Safeguards, 'log-in monitoring' is classified as:

Accepted Answer

An addressable implementation specification under security awareness and training

Answer

Log-in monitoring is an addressable implementation specification under the security awareness and training standard, focusing on training staff to monitor login attempts.

Question 3

A covered entity conducts a risk assessment and identifies that unencrypted laptops pose a significant risk to ePHI. The entity decides not to encrypt them due to cost. This decision is:

Accepted Answer

Not acceptable because risk management must address identified risks

Answer

Risk management requires implementing security measures sufficient to reduce identified risks to a reasonable and appropriate level; simply accepting a significant risk without mitigation violates this requirement.

Question 4

Which HIPAA standard requires covered entities to document the rationale for security policy decisions?

Accepted Answer

Documentation standard

Answer

The documentation standard (§164.316) requires covered entities to maintain written policies and procedures and to document decisions, including reasons for implementing or not implementing certain controls.

Question 5

An evaluation under HIPAA's Administrative Safeguards must be performed:

Accepted Answer

Periodically and in response to environmental or operational changes

Answer

Covered entities must perform a periodic technical and nontechnical evaluation based on standards and in response to environmental or operational changes affecting ePHI security.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Administrative Safeguards 4