Which is NOT an element of Security Awareness Training?

Question

Options

• ADetermination that all staff will receive security training
• BPolicy related to documentation of all security training
• CProcedural issues of who will terminate user access
• DTraining on vulnerabilities of the electronic Protected Health Information policies

• A
  3% (2)
• B
  3% (2)
• C
  87% (53)
• D
  7% (4)

Explanation

Option C describes an access control procedure, not a Security Awareness Training element. Terminating user access is an administrative/operational task handled under workforce management or access control policies - it belongs to a different HIPAA Security Rule category, not the training program itself.

Why the distractors are wrong:

• A is a core training element - organizations must determine who needs training and ensure all relevant staff receive it.
• B is also required - documenting that training occurred (and who completed it) is a mandated component of a compliant training program.
• D is exactly what training covers - educating staff on ePHI vulnerabilities is the substance of security awareness training.

Memory tip: Ask yourself, "Is this about the training itself?" - planning it (A), documenting it (B), and delivering content about ePHI risks (D) all directly describe the training program. Terminating user access (C) is something you do to a system, not something you teach in a classroom - it's an HR/IT procedure that lives under access management, not training.

No community discussion yet for this question.