Technical & Physical Safeguards Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Technical & Physical Safeguards flashcards as text
Under HIPAA's Facility Access Controls standard, the 'maintenance records' specification requires covered entities to document:
Answer: Repairs and modifications to physical security components of a facility
Maintenance records capture repairs and modifications to physical security components — such as locks, doors, or alarms — that protect facilities housing ePHI.
A covered entity uses badge readers, security cameras, and security guards to protect its data center. Together, these controls satisfy which HIPAA safeguard standard?
Answer: Facility Access Controls
Facility Access Controls include physical and procedural measures — such as badge readers, cameras, and guards — that limit access to facilities housing ePHI systems.
Which HIPAA Technical Safeguard standard requires that covered entities implement hardware, software, or procedural mechanisms to record and examine activity in systems containing ePHI?
Answer: Audit Controls
Audit Controls require mechanisms to record and examine access and other activity in systems that create, maintain, or transmit ePHI.
A hospital disposes of old hard drives by destroying them physically. This practice is required under which HIPAA specification?
Answer: Disposal — Device and Media Controls
The Disposal specification under Device and Media Controls requires that ePHI be removed from electronic media before disposal, through destruction or other approved methods.
An organization allows employees to access ePHI through a VPN with TLS encryption. Which technical safeguard standard does this most directly satisfy?
Answer: Transmission Security
Transmission Security requires guarding ePHI from unauthorized access during electronic transmission; encrypted VPN tunnels satisfy this standard.
Under the Workstation Security specification, covered entities must implement physical safeguards for all workstations that access ePHI. What does this primarily involve?
Answer: Restricting physical access to workstations to authorized users only
Workstation Security focuses on physical safeguards — such as cable locks, privacy screens, and restricted areas — to prevent unauthorized physical access to workstations.
Which HIPAA implementation specification supports emergency access to ePHI when normal access controls are unavailable?
Answer: Emergency Access Procedure
Emergency Access Procedure is a required implementation specification under the Access Control standard that establishes how to access ePHI during emergency situations.