Information Security sample questions

Does the organization have policies covering the control of access to patient-identifiable health information?

Does the organization monitor access to patient information?

Impact Analysis Methodology page