HCISPP Access Control & Identity Management in Healthcare 2

Question 1

A covered entity wants to ensure that only authorized users access PHI stored in its EHR system. Which technical safeguard required by the HIPAA Security Rule DIRECTLY addresses this?

Accepted Answer

Unique user identification

Answer

Audit controls

Answer

Transmission security

Answer

Encryption and decryption

Question 2

In a healthcare context, 'privileged access' typically refers to:

Accepted Answer

Elevated system or administrative rights granted to IT staff or database administrators

Answer

Access granted to patients to view their own medical records

Answer

Physician-level permissions to order controlled substances

Answer

The ability to override EHR alerts and warnings

Question 3

A healthcare organization conducts quarterly reviews to ensure that access permissions for all users remain appropriate for their current roles. This process is known as:

Accepted Answer

Access recertification or access review

Answer

Penetration testing

Answer

Identity proofing

Answer

Risk stratification

Question 4

A nurse logs into a shared workstation using her credentials and then walks away without logging out. A colleague then views a patient record under her session. Which control would BEST prevent this scenario?

Accepted Answer

Implementing automatic session timeout and screen lock

Answer

Requiring biometric authentication at login

Answer

Enforcing password complexity requirements

Answer

Using an intrusion detection system

Question 5

Which identity management concept involves verifying that a person is who they claim to be before granting them a digital credential or account in a healthcare system?

Accepted Answer

Identity proofing

Answer

Authorization

Answer

Access governance

Answer

Credential lifecycle management

Question 6

In healthcare, 'context-based access control' might be used to restrict access to PHI based on which of the following factors?

Accepted Answer

The time of day, location, and device being used to access data

Answer

The color of the hospital badge worn by the employee

Answer

The number of patients assigned to the clinician

Answer

The employee's years of service at the organization

Question 7

Which of the following BEST describes the 'principle of least privilege' in a healthcare IT environment?

Accepted Answer

Users receive only the access rights necessary to perform their specific job functions

Answer

Users are granted the lowest level of encryption for non-sensitive data

Answer

New employees are given no access until their training is complete

Answer

System administrators restrict all remote access to the EHR