HIPAA Electronic Health Records (EHR) Compliance 3

Question 1

Which of the following is an example of an addressable implementation specification under the HIPAA Security Rule for EHR systems?

Accepted Answer

Encryption of ePHI at rest

Answer

Encryption of ePHI at rest is an addressable specification, meaning covered entities must implement it or document why an equivalent alternative is used.

Question 2

A medical practice uses a cloud-based EHR. Which document must exist between the practice and the cloud provider before ePHI is stored?

Accepted Answer

Business Associate Agreement

Answer

A Business Associate Agreement (BAA) is required before a covered entity shares ePHI with any third-party vendor, including cloud EHR providers.

Question 3

Under HIPAA, what constitutes a breach involving an EHR when an employee accesses the record of a celebrity patient out of curiosity?

Accepted Answer

It is a presumed breach unless the covered entity can show low probability of compromise

Answer

Any unauthorized access to ePHI is presumed a breach under HIPAA unless the covered entity performs a four-factor risk assessment showing low probability of compromise.

Question 4

Which federal agency is responsible for enforcing HIPAA compliance related to EHR security?

Accepted Answer

Office for Civil Rights (OCR)

Answer

The HHS Office for Civil Rights (OCR) is the primary enforcement agency for HIPAA Privacy and Security Rule violations.

Question 5

A nurse logs into an EHR workstation and steps away without logging out. Which HIPAA technical safeguard addresses this risk?

Accepted Answer

Automatic logoff

Answer

Automatic logoff is a HIPAA-required technical safeguard that terminates an EHR session after a period of inactivity to prevent unauthorized access.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Electronic Health Records (EHR) Compliance 3