Equipment Operation & Maintenance Flashcards
7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Equipment Operation & Maintenance flashcards as text
A nurse's personal smartphone is used to photograph wound progress for the patient record. Under HIPAA, this practice requires:
Answer: A formal BYOD policy that addresses ePHI handling, encryption, and remote wipe capability
BYOD (Bring Your Own Device) programs must include formal policies covering ePHI safeguards such as encryption, containerization, and remote wipe to comply with the HIPAA Security Rule.
Which feature of a mobile device management (MDM) platform most directly supports HIPAA's requirement for ePHI protection on portable devices?
Answer: Remote wipe capability in case of loss or theft
Remote wipe allows an organization to erase ePHI from a lost or stolen device, directly addressing the Security Rule's device and media controls requirement.
A tablet used for electronic prescribing is left unattended at a nursing station for 20 minutes. Which automatic control would BEST mitigate unauthorized ePHI access?
Answer: Automatic logoff after a period of inactivity
Automatic logoff (§164.312(a)(2)(iii)) is an addressable implementation specification that prevents unauthorized access when a workstation or device is left unattended.
An organization discovers that a vendor-managed infusion pump transmits patient data over an unencrypted Wi-Fi channel. The FIRST step should be:
Answer: Conduct a risk analysis to assess the likelihood and impact of a breach
A risk analysis is the foundational required step under §164.308(a)(1) to evaluate the probability and impact of potential ePHI exposure before deciding on remediation.
A practice manager finds an old fax machine that occasionally received PHI now needs decommissioning. Which action is MOST important?
Answer: Clearing stored fax memory and any internal print logs before disposal
Fax machines with memory must have stored transmissions and internal logs cleared before disposal to prevent unauthorized access to stored PHI, per Device and Media Controls.
What does HIPAA's 'Unique User Identification' implementation specification (§164.312(a)(2)(i)) require for shared medical equipment?
Answer: Every user must be assigned and use a unique identifier to track individual access
Unique User Identification requires that each individual user be assigned a unique ID so that access to ePHI can be tracked and attributed to specific persons.
A telehealth platform used on clinic-owned tablets sends video directly through a public internet connection without a BAA in place with the software vendor. This is:
Answer: A HIPAA violation because the vendor is a business associate without a BAA
A telehealth software vendor that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate, and a BAA is required before use.