Marcus is responsible for security management within a HIPAA-covered entity. He is reviewing administrative safeguards and examining the organization's risk analysis. Which element is NOT part of…

Question

Options

• ADeveloping adequate communication with all contractors, interns, and staff in relation to the
• BAssessing vulnerabilities of integrity and availability of electronic personal health information
• CDetermining how client electronic personal health information confidentiality may be compromised
• DDetermining barriers in existence to needed client electronic personal health information

• A
  72% (18)
• B
  8% (2)
• C
  16% (4)
• D
  4% (1)

Explanation

Option A describes a workforce communication activity, which falls under a separate HIPAA administrative safeguard - workforce security and training - not risk analysis. Risk analysis is specifically a threat-and-vulnerability assessment process focused on identifying risks to ePHI, not establishing communication protocols.

Options B, C, and D are all genuine risk analysis components: B addresses assessing system vulnerabilities to ePHI integrity and availability, C covers identifying threats to confidentiality, and D involves evaluating existing controls (barriers) that affect ePHI access - all of which directly map to the HIPAA Security Rule's risk analysis requirements under 45 CFR §164.308(a)(1).

Memory tip: Think of risk analysis using the CIA triad - Confidentiality, Integrity, Availability. Any answer choice that assesses threats or vulnerabilities to those three pillars belongs in risk analysis. Communication and training activities belong to other administrative safeguards, so when a choice mentions talking to staff or contractors, it's likely pointing outside the risk analysis bucket.

No community discussion yet for this question.