HCISPP Access Control & Identity Management in Healthcare 3

Question 1

A hospital's security policy requires that users accessing PHI from outside the corporate network use a VPN with certificate-based authentication.
This requirement primarily addresses which security objective?

Accepted Answer

Secure remote access and identity verification

Answer

Data integrity

Answer

Non-repudiation

Answer

Physical security of workstations

Question 2

Under the HIPAA Security Rule, covered entities must implement procedures to verify that a person or entity seeking access to ePHI is the one claimed. This is specifically addressed by which implementation specification?

Accepted Answer

Person or entity authentication

Answer

Audit controls

Answer

Transmission encryption

Answer

Emergency access procedure

Question 3

A healthcare organization discovers that a former contractor's account was still active six months after the contract ended. This indicates a failure in which process?

Accepted Answer

Account deprovisioning in the identity lifecycle

Answer

Security incident response

Answer

Workforce training

Answer

Encryption key management

Question 4

Which approach allows a healthcare organization to manage access across multiple affiliated hospitals and clinics by recognizing credentials issued by partner institutions?

Accepted Answer

Federated Identity Management

Answer

Mandatory Access Control

Answer

Role-Based Access Control

Answer

Discretionary Access Control

Question 5

A healthcare CISO wants to reduce the risk of credential theft by ensuring that even if a password is stolen, an attacker cannot gain access. The MOST effective control to implement is:

Accepted Answer

Implementing multi-factor authentication (MFA)

Answer

Increasing password length requirements to 20 characters

Answer

Switching to passphrases instead of passwords

Answer

Requiring monthly password changes

Question 6

A healthcare organization is implementing a new EHR system and must decide how to structure user permissions. Which approach aligns BEST with both the HIPAA minimum necessary standard and the principle of least privilege?

Accepted Answer

Define granular roles aligned to job functions and assign only required permissions to each role

Answer

Grant all clinical staff full access to ensure they can always care for any patient

Answer

Allow department managers to set their own access rules for team members

Answer

Provide read-only access to all staff and require written requests for additional rights

Question 7

In healthcare identity management, 'just-in-time (JIT) provisioning' refers to:

Accepted Answer

Automatically creating a user account in a target system the first time the user attempts to log in via SSO

Answer

Creating user accounts immediately upon hire, before training is complete

Answer

Provisioning emergency access accounts only when a patient crisis occurs

Answer

Scheduling access removal to occur exactly at the end of a work shift