Examkin

Question

Difficulty: Very hardConfidentiality and Information Security

While actively charting in a client's electronic health record (EHR), a registered nurse (RN) encounters a sudden screen lock accompanied by a pop-up message demanding a financial payment to decrypt the files. Arrange the following actions in the priority order the RN should execute them to ensure information security and client safety. (Place the first action at the top and the last action at the bottom.)

  1. 1Disconnect the affected computer workstation from the facility's local network or Wi-Fi.
  2. 2Notify the nursing supervisor and the Information Technology (IT) department's emergency response line.
  3. 3Implement established facility downtime procedures and initiate paper-based documentation.
  4. 4Store all newly generated paper health records in secure, restricted-access locations on the unit.
  5. 5Retroactively enter all paper-documented clinical data into the EHR once IT declares the system restored.

Answer

The correct sequence of actions is: 1. Disconnect the workstation from the network, 2. Notify the nursing supervisor and IT, 3. Implement downtime procedures, 4. Store paper records securely, 5. Retroactively enter data once the system is restored.
In the event of a cyberattack such as ransomware, the immediate nursing priority is containment to protect the broader facility infrastructure. Disconnecting the infected device from the network prevents the malware from spreading to other hospital systems. Following containment, escalating the issue to IT and nursing leadership ensures a coordinated facility response. Because the EHR is inaccessible, the nurse must then implement downtime procedures to maintain client care, ensuring that physical paper records are kept secure to maintain HIPAA compliance. Finally, once the cyber threat is neutralized and systems are restored, all paper documentation must be entered into the EHR to ensure a complete, accurate legal medical record.

Step-by-Step Solution

1
Analyze the scenario to identify the primary threat.
The primary threat is a ransomware attack that compromises the EHR and could spread across the hospital network, jeopardizing all electronic protected health information (ePHI).
Understanding the nature of the cyber threat determines the urgency and prioritization of the initial response.
2
Determine the immediate action to mitigate the spread of the threat.
Disconnecting the affected computer workstation from the network.
Isolating the infected endpoint is the critical first step in cybersecurity incident response to prevent lateral movement of the malware.
3
Identify the next logical steps for reporting and maintaining care.
Reporting the incident to IT and management, followed by initiating downtime procedures.
Once contained, experts must be mobilized to address the system-wide threat, while clinical staff must ensure client care continues without interruption using paper records.
4
Determine how to manage PHI during and after the downtime.
Securing paper records during the outage, then retroactively entering data when the system is safe.
Confidentiality must be maintained continuously, transitioning from electronic to physical safeguards, and finally restoring the complete electronic record for continuity.

Key Concept

Cybersecurity Incident Response and EHR Downtime Procedures
Rate this question

Topics

Confidentiality and Information Security

More questions from this topic