HIPAA Risk Analysis and Risk Management 5 — Questions and Answers
Question 1: After completing a risk analysis, how should a covered entity generally prioritize remediation in its risk management plan?
- Address the highest-rated risks first (Correct answer)
- Address the cheapest fixes first regardless of risk
- Address risks in alphabetical order by system name
- Wait until a breach occurs to decide
Correct answer: Address the highest-rated risks first
Risk management should prioritize measures based on the risk levels assigned during the analysis.
Question 2: Which Security Rule standard requires identifying one person responsible for developing and implementing security policies and procedures?
- Workforce clearance procedure
- Business associate contracts
- Facility access controls
- Assigned security responsibility (Correct answer)
Correct answer: Assigned security responsibility
164.308(a)(2) requires designating a security official responsible for Security Rule policies and procedures.
Question 3: The information system activity review specification requires regular review of which records?
- Patient billing statements
- Audit logs, access reports, and security incident tracking reports (Correct answer)
- Employee performance reviews
- Marketing communications
Correct answer: Audit logs, access reports, and security incident tracking reports
Under 164.308(a)(1)(ii)(D), entities must regularly review system activity records such as audit logs and access reports.
Question 4: A nurse repeatedly accesses records of patients not under her care. Which Security Management Process specification requires the hospital to have a policy for responding?
- Risk analysis
- Contingency plan
- Sanction policy (Correct answer)
- Device and media controls
Correct answer: Sanction policy
The sanction policy requires appropriate sanctions against workforce members who fail to comply with security policies.
Question 5: A hospital migrates to a new EHR system hosted by a different vendor. What should it do regarding its risk analysis?
- Update the risk analysis to address new risks introduced by the change (Correct answer)
- Nothing, until the next three-year cycle
- Rely on the vendor's marketing materials
- Discard the old analysis without replacement
Correct answer: Update the risk analysis to address new risks introduced by the change
Significant operational or technology changes should trigger a review and update of the risk analysis.
Question 6: Is the risk analysis implementation specification under the HIPAA Security Rule 'required' or 'addressable'?
- Addressable for small practices only
- Addressable for all entities
- Optional if the entity uses encryption
- Required for all covered entities and business associates (Correct answer)
Correct answer: Required for all covered entities and business associates
Risk analysis is a required implementation specification with no addressable alternative.
Question 7: Why does OCR caution that a 'gap analysis' is typically not sufficient to satisfy the risk analysis requirement?
- Gap analyses are prohibited by HIPAA
- A gap analysis usually reviews existing controls against requirements but does not assess the likelihood and impact of risks to all ePHI (Correct answer)
- Gap analyses must be performed by OCR staff
- Gap analyses only cover paper records
Correct answer: A gap analysis usually reviews existing controls against requirements but does not assess the likelihood and impact of risks to all ePHI
OCR states a gap analysis is a partial review and does not meet the enterprise-wide risk assessment requirement.
