mediumMultiple ChoiceObjective-mapped
CISA Practice Question: A healthcare organization is required to comply…
A healthcare organization is required to comply with HIPAA regulations for protecting electronic protected health information (ePHI). The organization uses a cloud-based electronic health record (EHR) system. During a compliance audit, it is discovered that some employees are accessing patient records without a legitimate business need. The EHR system logs all access, but there is no automated process to review logs or detect anomalous behavior. The organization has implemented role-based access control (RBAC) and requires strong passwords, but unauthorized access continues. The IT manager proposes implementing a security information and event management (SIEM) system to collect and correlate logs. However, the budget is limited. Which additional control would be most cost-effective to reduce unauthorized access to patient records?
⚠ Common exam trap
Many exam-takers choose encryption (Option B) as a catch-all security control, but encryption does not address the insider threat of authorized users abusing their access—it only protects data from external interception or theft.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing user behavior analytics (UBA) on the EHR access logs
User behavior analytics (UBA) is the most cost-effective control because it directly addresses the core issue: unauthorized access by insiders. UBA applies machine learning to EHR access logs to establish baselines of normal user behavior and detect anomalous patterns (e.g., accessing records outside work hours or from unusual locations) without requiring manual log review. This provides automated, real-time detection of the specific unauthorized access incidents that are occurring, which the current logging system alone cannot provide.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Conducting a quarterly review of user access rights and removing unnecessary privileges
Why it's wrong here
Periodic review is good but does not detect ongoing misuse.
- ✗
Encrypting all ePHI at rest and in transit
Why it's wrong here
Encryption protects data in case of theft but does not prevent authorized user misuse.
- ✗
Increasing the logging level to capture every keystroke
Why it's wrong here
More logs without analysis increase noise and cost.
- ✓
Implementing user behavior analytics (UBA) on the EHR access logs
Why this is correct
UBA detects anomalous behavior without manual review.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 995-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.