HIPAA Risk Analysis and Risk Management 5

Question 1

After completing a risk analysis, how should a covered entity generally prioritize remediation in its risk management plan?

Accepted Answer

Address the highest-rated risks first

Answer

Risk management should prioritize measures based on the risk levels assigned during the analysis.

Question 2

Which Security Rule standard requires identifying one person responsible for developing and implementing security policies and procedures?

Accepted Answer

Assigned security responsibility

Answer

164.308(a)(2) requires designating a security official responsible for Security Rule policies and procedures.

Question 3

The information system activity review specification requires regular review of which records?

Accepted Answer

Audit logs, access reports, and security incident tracking reports

Answer

Under 164.308(a)(1)(ii)(D), entities must regularly review system activity records such as audit logs and access reports.

Question 4

A nurse repeatedly accesses records of patients not under her care. Which Security Management Process specification requires the hospital to have a policy for responding?

Accepted Answer

Sanction policy

Answer

The sanction policy requires appropriate sanctions against workforce members who fail to comply with security policies.

Question 5

A hospital migrates to a new EHR system hosted by a different vendor. What should it do regarding its risk analysis?

Accepted Answer

Update the risk analysis to address new risks introduced by the change

Answer

Significant operational or technology changes should trigger a review and update of the risk analysis.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Risk Analysis and Risk Management 5