The HIPPA task force must first:

Question

Options

• Ainventory the organization's systems, processes, policies, procedures and data to determine which
• Binventory the organization's systems, processes, policies, procedures and data to determine which
• Cinventory the organization's systems, processes, policies, procedures and data to determine which
• Dmodify the organization's systems, processes, policies, procedures and data to determine which

• A
  79% (34)
• B
  5% (2)
• C
  2% (1)
• D
  14% (6)

Explanation

Option A is correct because HIPAA compliance requires organizations to first understand their current state before taking any action - you cannot protect what you haven't identified. Conducting a full inventory of systems, processes, policies, procedures, and data establishes the baseline needed for a proper risk assessment, which is the foundational step mandated by the HIPAA Security Rule.

Options B and C appear identical to A and are likely distractors with subtle wording differences in the original source (possibly specifying which data is in scope differently) - without the full text, they represent the trap of choosing a nearly-correct answer. Option D is clearly wrong because modifying before inventorying skips the discovery phase; you cannot make informed, compliant changes to systems or policies you haven't yet catalogued.

Memory tip: Think "assess before address" - HIPAA task forces must assess (inventory) the environment before they address (modify) anything. Inventory = first step, always.

No community discussion yet for this question.