HIPAA Electronic Health Records (EHR) Compliance

Question 1

Under HIPAA, which of the following is a primary requirement for electronic health record systems handling Protected Health Information (PHI)?

Accepted Answer

Implementing access controls that limit PHI access to authorized users

Answer

Storing all records on local servers only

Answer

Printing all records daily as a backup

Answer

Sharing EHR login credentials among staff for efficiency

Question 2

A hospital migrates to a new EHR system. What HIPAA requirement applies to PHI stored in the old system?

Accepted Answer

It must be retained according to applicable retention laws and securely disposed of when no longer needed

Answer

It must be immediately deleted upon migration

Answer

It can be transferred to a public cloud without restrictions

Answer

It must be printed and stored in physical files

Question 3

Which HIPAA Security Rule standard directly addresses the integrity of electronic PHI in EHR systems?

Accepted Answer

Integrity Controls

Answer

Workforce Security

Answer

Contingency Planning

Answer

Facility Access Controls

Question 4

A physician practice uses a cloud-based EHR platform. Under HIPAA, what document is required between the practice and the EHR vendor?

Accepted Answer

A Business Associate Agreement (BAA)

Answer

A Non-Disclosure Agreement (NDA)

Answer

A Service Level Agreement (SLA) only

Answer

A HIPAA Certification Letter

Question 5

Under HIPAA, an EHR system's audit log must capture which of the following?

Accepted Answer

User activity including access, modifications, and disclosures of PHI

Answer

Only unsuccessful login attempts

Answer

Only administrative changes to the system

Answer

System performance metrics only

Question 6

A covered entity discovers that their EHR vendor experienced a data breach. Under HIPAA, when must the covered entity notify affected patients?

Accepted Answer

Within 60 days of discovery of the breach

Answer

Within 24 hours of discovery

Answer

Within 6 months of the breach

Answer

Only if more than 1,000 patients are affected

Question 7

Which of the following best describes the 'minimum necessary' standard as applied to EHR access?

Accepted Answer

Access to PHI should be limited to the minimum needed to perform a job function

Answer

All staff should have access to all patient records

Answer

Minimum necessary only applies to paper records

Answer

Physicians are exempt from minimum necessary requirements

Question 8

What is the purpose of automatic logoff in an EHR system under HIPAA?

Accepted Answer

To terminate sessions and prevent unauthorized access after a period of inactivity

Answer

To reduce server load during peak hours

Answer

To generate automatic backup copies of open records

Answer

To log patient satisfaction scores automatically

Question 9

An EHR system must transmit patient data to a referring specialist. Which HIPAA requirement applies to this transmission?

Accepted Answer

Encryption must be used to protect ePHI during transmission over open networks

Answer

Transmission is prohibited without patient consent for each transfer

Answer

Only fax transmission is compliant with HIPAA

Answer

No special requirements apply to internal system transmissions

Question 10

Which federal law expanded HIPAA's requirements and directly increased compliance obligations for EHR systems?

Accepted Answer

The HITECH Act of 2009

Answer

The Affordable Care Act (ACA)

Answer

The Medicare Access and CHIP Reauthorization Act (MACRA)

Answer

The Health Information Technology Standards Act