HIPAA Administrative Safeguards 5

Question 1

Under HIPAA, how long must covered entities retain documentation of their security policies and procedures?

Accepted Answer

6 years from the date of creation or last effective date

Answer

HIPAA requires that documentation of security policies and procedures be retained for 6 years from the date of creation or the date it was last in effect, whichever is later.

Question 2

A covered entity's risk management plan must reduce risks to ePHI to:

Accepted Answer

A reasonable and appropriate level

Answer

Risk management requires implementing security measures to reduce risks and vulnerabilities to a reasonable and appropriate level, not to eliminate all risk.

Question 3

Which scenario represents proper use of the 'applications and data criticality analysis' specification within the contingency plan?

Accepted Answer

Ranking ePHI applications by their business importance to prioritize recovery order

Answer

Applications and data criticality analysis involves assessing the relative criticality of specific applications and data to prioritize recovery efforts during a disaster.

Question 4

Security awareness training under HIPAA must be provided to workforce members:

Accepted Answer

Periodically and with updates as environmental changes warrant

Answer

Training must be provided to all workforce members periodically and updated as needed when environmental or operational changes affect ePHI security.

Question 5

A clinic's IT administrator implements automatic logoff on workstations after 15 minutes of inactivity. Which standard does this support?

Accepted Answer

Access control (Technical Safeguards)

Answer

Automatic logoff is a Technical Safeguard under access control, not an Administrative Safeguard, though administrative policies may require it.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Administrative Safeguards 5