HIPAA The HIPAA Security Rule 4

Question 1

Under the HIPAA Security Rule, which safeguard category includes the requirement for 'device and media controls'?

Accepted Answer

Physical Safeguards

Answer

Device and Media Controls is a standard under Physical Safeguards governing the receipt, removal, and disposal of hardware and media containing ePHI.

Question 2

A practice must reassign a user's ePHI access rights when that user changes roles. Which specification addresses this?

Accepted Answer

Access Establishment and Modification

Answer

Access Establishment and Modification is an addressable specification requiring policies to grant, change, and revoke access rights based on an employee's role.

Question 3

What is the difference between a 'threat' and a 'vulnerability' in the context of a HIPAA Security Rule risk analysis?

Accepted Answer

A threat is a potential danger to ePHI; a vulnerability is a weakness that could be exploited by a threat

Answer

In risk analysis, a threat is a potential occurrence that could negatively impact ePHI, while a vulnerability is a flaw or weakness that increases the likelihood of that threat causing harm.

Question 4

A clinic stores backup tapes of ePHI in an unlocked supply closet. Which Security Rule standard is most directly violated?

Accepted Answer

Device and Media Controls

Answer

Device and Media Controls requires covered entities to implement policies for the secure storage and handling of media containing ePHI.

Question 5

Which of the following must be documented and retained for at least six years under the HIPAA Security Rule?

Accepted Answer

Security Rule policies, procedures, and actions

Answer

The Security Rule requires covered entities to retain documentation of their policies, procedures, and required actions for a minimum of six years from creation or last effective date.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA The HIPAA Security Rule 4