HCISPP Access Control & Identity Management in Healthcare

Question 1

Which access control model is most commonly used in healthcare settings to grant permissions based on a user's job function?

Accepted Answer

Role-Based Access Control (RBAC)

Answer

Mandatory Access Control (MAC)

Answer

Discretionary Access Control (DAC)

Answer

Attribute-Based Access Control (ABAC)

Question 2

Under HIPAA, workforce members should only have access to the minimum amount of PHI necessary to perform their job duties. This principle is known as:

Accepted Answer

Minimum necessary standard

Answer

Need-to-know principle

Answer

Least privilege doctrine

Answer

Access transparency rule

Question 3

A hospital implements a system where clinicians must provide their username, password, and a fingerprint scan before accessing the EHR. This is an example of:

Accepted Answer

Multi-factor authentication

Answer

Single-factor authentication

Answer

Two-factor authentication

Answer

Federated authentication

Question 4

When a healthcare employee is transferred to a different department, the security team should immediately review and update their system access. This practice is part of:

Accepted Answer

User provisioning lifecycle management

Answer

Access recertification

Answer

Privilege escalation management

Answer

Identity federation

Question 5

A healthcare organization uses a single login that allows staff to access multiple applications such as the EHR, billing system, and HR portal without logging in separately to each. This is called:

Accepted Answer

Single Sign-On (SSO)

Answer

Multi-factor authentication

Answer

Federated identity management

Answer

Privileged Access Management

Question 6

Which of the following BEST describes the principle of 'separation of duties' as applied to healthcare information security?

Accepted Answer

Ensuring no single user can perform all critical tasks without oversight

Answer

Dividing the IT department into separate security and operations teams

Answer

Requiring two clinicians to co-sign every patient record

Answer

Separating PHI databases from administrative databases

Question 7

An employee whose role requires access to PHI resigns. What is the FIRST action the security team should take regarding their system access?

Accepted Answer

Disable or revoke the employee's access credentials immediately

Answer

Archive all files accessed by the employee

Answer

Transfer the employee's account to their supervisor

Answer

Generate an audit report of all recent access activity