Author: Anonymous

If the specification is unreasonable and inappropriate for the CE, but the overall standard can be met without alternate measures, then the CE must document why it is unreasonable and inappropriate.

The Security Rule can be characterized for including a minimum security baseline that is intended to help prevent unauthorized use and disclosure of PHI.

If The implementation specification is reasonable and appropriate for the CE, then the CE must implement an alternate security measure to accomplish the same goal.

When performing a risk analysis, organizations must determine both tangible and intangible costs associated with your PHI and its supporting systems.

Requirements for PHI breaches revolve around risk assessment of what actually occurred. At least three of the following must be considered:

When calculating risk, risk is defined in the following formula: Risk = ______ × _______ × ________

A risk analysis will help organizations determine the following:

As outlined in 45 CFR § 164.316 of the Security Rule, CEs must  implement reasonable and appropriate policies and procedures to comply with the standards, implementation specifications, or other requirements of the Security Rule.

A risk mitigation plan include the following options: (Choose all that apply)

The Security Rule is not: (please check all that apply)