HIPAA Administrative Safeguards 5 — Questions and Answers
Question 1: Under HIPAA, how long must covered entities retain documentation of their security policies and procedures?
- 3 years from the date of creation or last effective date
- 6 years from the date of creation or last effective date (Correct answer)
- 7 years, consistent with IRS record retention rules
- 10 years, consistent with Medicare record retention
Correct answer: 6 years from the date of creation or last effective date
HIPAA requires that documentation of security policies and procedures be retained for 6 years from the date of creation or the date it was last in effect, whichever is later.
Question 2: A covered entity's risk management plan must reduce risks to ePHI to:
- Zero risk, as required by the statute
- A level sufficient to comply with HIPAA General Rules
- A reasonable and appropriate level (Correct answer)
- Below the industry average benchmark
Correct answer: A reasonable and appropriate level
Risk management requires implementing security measures to reduce risks and vulnerabilities to a reasonable and appropriate level, not to eliminate all risk.
Question 3: Which scenario represents proper use of the 'applications and data criticality analysis' specification within the contingency plan?
- Ranking ePHI applications by their business importance to prioritize recovery order (Correct answer)
- Performing a penetration test on critical applications annually
- Deleting non-critical applications to reduce attack surface
- Archiving low-priority data to offline storage
Correct answer: Ranking ePHI applications by their business importance to prioritize recovery order
Applications and data criticality analysis involves assessing the relative criticality of specific applications and data to prioritize recovery efforts during a disaster.
Question 4: Security awareness training under HIPAA must be provided to workforce members:
- Upon hiring only
- Annually, as required by regulation
- Periodically and with updates as environmental changes warrant (Correct answer)
- Only when a security incident occurs
Correct answer: Periodically and with updates as environmental changes warrant
Training must be provided to all workforce members periodically and updated as needed when environmental or operational changes affect ePHI security.
Question 5: A clinic's IT administrator implements automatic logoff on workstations after 15 minutes of inactivity. Which standard does this support?
- Workforce security
- Security awareness and training
- Access control (Technical Safeguards) (Correct answer)
- Information access management
Correct answer: Access control (Technical Safeguards)
Automatic logoff is a Technical Safeguard under access control, not an Administrative Safeguard, though administrative policies may require it.
Question 6: Under the Information Access Management standard, which implementation specification controls who can access ePHI based on job function?
- Access establishment and modification (Correct answer)
- Workforce clearance procedure
- Authorization and/or supervision
- Isolating health care clearinghouse functions
Correct answer: Access establishment and modification
Access establishment and modification requires documented policies for granting, changing, and revoking ePHI access based on the workforce member's role.
Question 7: A covered entity that is also a health care clearinghouse must, under Administrative Safeguards:
- Obtain separate HIPAA certification for clearinghouse functions
- Implement policies to protect ePHI from unauthorized access by the rest of the organization (Correct answer)
- File separate risk analyses for each line of business
- Have separate Security Officers for clearinghouse and covered entity functions
Correct answer: Implement policies to protect ePHI from unauthorized access by the rest of the organization
If a covered entity performs clearinghouse functions, it must implement policies to protect clearinghouse ePHI from unauthorized access by the larger organization.
HIPAA Administrative Safeguards 5
Under HIPAA, how long must covered entities retain documentation of their security policies and procedures?