HIPAA Administrative Safeguards 5

Question 1

Under HIPAA, how long must covered entities retain documentation of their security policies and procedures?

Accepted Answer

6 years from the date of creation or last effective date

Answer

3 years from the date of creation or last effective date

Answer

7 years, consistent with IRS record retention rules

Answer

10 years, consistent with Medicare record retention

Question 2

A covered entity's risk management plan must reduce risks to ePHI to:

Accepted Answer

A reasonable and appropriate level

Answer

Zero risk, as required by the statute

Answer

A level sufficient to comply with HIPAA General Rules

Answer

Below the industry average benchmark

Question 3

Which scenario represents proper use of the 'applications and data criticality analysis' specification within the contingency plan?

Accepted Answer

Ranking ePHI applications by their business importance to prioritize recovery order

Answer

Performing a penetration test on critical applications annually

Answer

Deleting non-critical applications to reduce attack surface

Answer

Archiving low-priority data to offline storage

Question 4

Security awareness training under HIPAA must be provided to workforce members:

Accepted Answer

Periodically and with updates as environmental changes warrant

Answer

Upon hiring only

Answer

Annually, as required by regulation

Answer

Only when a security incident occurs

Question 5

A clinic's IT administrator implements automatic logoff on workstations after 15 minutes of inactivity. Which standard does this support?

Accepted Answer

Access control (Technical Safeguards)

Answer

Workforce security

Answer

Security awareness and training

Answer

Information access management

Question 6

Under the Information Access Management standard, which implementation specification controls who can access ePHI based on job function?

Accepted Answer

Access establishment and modification

Answer

Workforce clearance procedure

Answer

Authorization and/or supervision

Answer

Isolating health care clearinghouse functions

Question 7

A covered entity that is also a health care clearinghouse must, under Administrative Safeguards:

Accepted Answer

Implement policies to protect ePHI from unauthorized access by the rest of the organization

Answer

Obtain separate HIPAA certification for clearinghouse functions

Answer

File separate risk analyses for each line of business

Answer

Have separate Security Officers for clearinghouse and covered entity functions