HIPAA - Health Insurance Portability and Accountability Act Technical & Physical Safeguards Questions and Answers

Question 1

A hospital is decommissioning several old servers that once stored ePHI.
The data has been backed up according to the contingency plan.
According to the HIPAA Security Rule's Physical Safeguards, which of the following actions is a required and appropriate final step for the physical server media before it leaves the hospital's control?

Accepted Answer

Degaussing or physically destroying the hard drives to render the ePHI unrecoverable.

Answer

Wiping the drives using a standard file deletion utility.

Answer

Removing the hospital's asset tags from the server chassis.

Answer

Donating the servers to a local charity "as is" with a disclaimer.

Question 2

A covered entity implements a system that assigns a unique username and number to each member of its workforce for tracking user identity and activity within the EHR system. This measure directly addresses which REQUIRED Technical Safeguard implementation specification?

Accepted Answer

Unique User Identification

Answer

Audit Controls

Answer

Person or Entity Authentication

Answer

Transmission Security

Question 3

A busy hospital nursing station has several computer workstations that are accessible in a high-traffic area. Which of the following is a key Physical Safeguard that must be implemented to protect ePHI at these workstations?

Accepted Answer

Implementing policies and procedures that specify how to secure workstations to prevent unauthorized access.

Answer

Installing the latest antivirus software on each workstation.

Answer

Encrypting all data transmitted from the workstations to the server.

Answer

Requiring all nurses to use complex, 12-character passwords.

Question 4

A medical lab needs to electronically transmit a patient's lab results, containing ePHI, to a specialist at another clinic over the internet. To comply with the HIPAA Security Rule, which Technical Safeguard is most critical to protect this data while it is in transit?

Accepted Answer

Encryption

Answer

Automatic Logoff

Answer

Data Backup and Storage

Answer

Facility Access Controls

Question 5

The HIPAA Security Rule requires covered entities to implement hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain or use ePHI. This requirement is known as:

Accepted Answer

Audit Controls

Answer

Integrity Controls

Answer

Access Control

Answer

Information System Activity Review

Question 6

A large data center that hosts ePHI for several hospitals implements security measures including biometric scanners at all entrances, logged entry for all personnel, and video surveillance in the server rooms. These measures are primary examples of which Physical Safeguard standard?

Accepted Answer

Facility Access Controls

Answer

Workstation Security

Answer

Device and Media Controls

Answer

Contingency Plan