Logging is required and is an essential element to create PHI audit trails.

When it comes to Data Backups and Storage, the following controls must be considered:

Security education and awareness training content should be specialized for target groups based on specific issues that they must understand and with which they must comply (Choos all that apply)

Requirements for PHI breaches revolve around risk assessment of what actually occurred. At least three of the following must be considered:

A Threat is an information system weakness that can be exploited to cause disturbance or harm to PHI

Apply appropriate sanctions against workforce members who fail to comply with the security policies and procedures of the covered entity, is a Sanction policy (required).

There are three main categories of policies:

Threats are an indication of intent to inflict harm or damage.

The Security Rule requires CEs, BAs, and subcontractors (also considered to be BAs under HIPAA) to perform an initial risk analysis to determine specific unauthorized uses, disclosures, and data integrity losses that could occur to PHI if the proper security systems and safeguards are not in place. 

The Security Rule covers all protected health information (PHI) that a covered entity (CE), business associate (BA), or any BA subcontractor ________, _________, ____________, or __________ in an electronic format.