Examkin

Question

Difficulty: MediumConfidentiality and Information Security

A registered nurse is documenting in the electronic health record (EHR) when a pop-up message appears on the screen stating that the computer has been locked and demanding a ransom payment to restore access. Arrange the nurse's subsequent actions in the correct sequence of priority.

  1. 1Disconnect the affected computer workstation from the facility's network.
  2. 2Contact the Information Technology (IT) security department to report the threat.
  3. 3Notify the charge nurse to warn other staff members on the unit.
  4. 4Initiate facility-approved downtime procedures to maintain continuity of care.
  5. 5Submit a formal incident report detailing the cybersecurity event.

Answer

The correct sequence is to first disconnect the computer, then contact IT security, notify the charge nurse, initiate downtime procedures, and finally submit an incident report.
The correct sequence prioritizes the immediate physical containment of the security breach to protect the wider hospital network, followed by alerting specialized IT personnel, warning the immediate clinical team, ensuring ongoing client care, and finally completing administrative documentation.

Step-by-Step Solution

1
Identify the active threat and disconnect the affected computer workstation from the facility's network.
The ransomware is isolated to a single device.
Containment is the absolute highest priority to prevent malicious software from spreading across the hospital network and compromising further Protected Health Information (PHI).
2
Contact the Information Technology (IT) security department.
IT professionals are alerted to the breach.
Specialized personnel must assess the attack, secure the broader network, and initiate the facility's formal cyber incident response plan.
3
Notify the charge nurse to warn other staff members.
The unit staff is made aware of the cyber threat.
Unit leadership must coordinate the clinical response and prevent other staff from logging into potentially compromised terminals, limiting further exposure.
4
Initiate facility-approved downtime procedures.
Client care and documentation continue safely without the EHR.
Nurses must maintain continuity of care using alternative methods (e.g., paper charting) when the electronic health record (EHR) is inaccessible or unsafe to use.
5
Submit a formal incident report.
The event is formally documented for internal review.
Administrative documentation is necessary for regulatory compliance and internal investigation, but must only occur after all immediate safety and operational priorities have been met.

Key Concept

Incident Response and Containment for Electronic Health Record (EHR) Breaches
Rate this question

Topics

Confidentiality and Information Security

More questions from this topic