HIPAA Technical & Physical Safeguards 5

Question 1

Under HIPAA, which of the following best distinguishes 'required' from 'addressable' implementation specifications?

Accepted Answer

Required specs must be implemented; addressable specs must be assessed and either implemented or documented as to why they are not reasonable

Answer

Required specifications must be implemented as stated; addressable specifications require a risk-based assessment and either implementation or documented justification for an alternative measure.

Question 2

A covered entity's access control policy assigns each employee a role (e.g., nurse, biller) and grants ePHI access based on that role. This implements which type of access control model?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Role-Based Access Control (RBAC) restricts system access based on a user's organizational role, which aligns with HIPAA's minimum necessary principle.

Question 3

A health system's security officer discovers that a former employee's access credentials were not disabled after termination. Which HIPAA technical safeguard was violated?

Accepted Answer

Access Control — Unique User Identification

Answer

Unique User Identification requires that access credentials are managed per individual, including timely revocation when employment ends.

Question 4

A covered entity needs to move a server containing ePHI to a new facility. Which physical safeguard specification is most relevant to documenting this move?

Accepted Answer

Device and Media Controls — Accountability

Answer

The Accountability specification under Device and Media Controls requires documenting the movement of hardware and electronic media and the individuals responsible.

Question 5

Which of the following is NOT a technical safeguard standard under the HIPAA Security Rule?

Accepted Answer

Workstation Security

Answer

Workstation Security is a Physical Safeguard standard, not a Technical Safeguard; the Technical Safeguard standards are Access Control, Audit Controls, Integrity, Person or Entity Authentication, and Transmission Security.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Technical & Physical Safeguards 5