Administrative Safeguards on Security Awareness related to electronic Protected Health Information (PHI) and Log-in Monitoring includes all, EXCEPT:

Question

Options

• AReview the system's login reports at regular intervals
• BProhibit the sharing of passwords among any employees, paid or unpaid
• CLimit the number of attempts a computer user can make at a log-in attempt
• DUse of software that locks the user out of the system after a certain number of unsuccessful log-in

• A
  5% (1)
• B
  82% (18)
• C
  5% (1)
• D
  9% (2)

Explanation

Option B describes a Password Management safeguard, not a Log-in Monitoring safeguard. Under HIPAA's Administrative Safeguards for Security Awareness and Training (§164.308(a)(5)), Log-in Monitoring and Password Management are two distinct implementation specifications - prohibiting password sharing belongs to the latter category, making it the odd one out.

Options A, C, and D are all correctly categorized under Log-in Monitoring: reviewing login reports (A) detects unauthorized access patterns, limiting login attempts (C) is a preventive control against brute-force attacks, and auto-lockout software (D) is the technical enforcement of that limit - all three directly relate to monitoring and controlling the login process itself.

Memory tip: Think of Log-in Monitoring as everything that happens at the login screen - reports, attempt limits, and lockouts. Password sharing is a behavioral/policy rule about what employees do before they even reach the login screen, so it belongs to Password Management instead.

No community discussion yet for this question.