A county clinic is rolling out clinic-wide Wi-Fi for clinician tablets that may display ePHI. What should the WLAN security requirements gathering emphasize under HIPAA-oriented expectations?
Select an answer to reveal the explanation.
Short Explanation
ePHI on a tablet is still ePHI when it rides Wi-Fi. Requirements should lock the door (access), wrap the packets (encryption), and keep a diary (logging)—not obsess over pretty heat maps or open SSIDs.
Full Explanation
When a county clinic rolls out clinician tablets that may display ePHI over Wi-Fi, HIPAA-oriented security requirements gathering must emphasize access control, encryption of wireless traffic, and logging sufficient to support privacy and security accountability. Controlled association and authentication limit who can join clinical SSIDs; link encryption protects ePHI in transit across the air; and audit logging supports investigations and compliance evidence when devices handle protected health information. An open SSID with MAC filtering alone is not an adequate access-control model for clinical risk—MAC addresses are spoofable and the air remains unprotected. Guest-portal branding and marketing analytics are business features that do not substitute for technical safeguards. Antenna gain settings and heat-map aesthetics optimize RF coverage; they are not primary compliance controls for confidentiality of ePHI. Exam caveat: HIPAA is risk-based and technology-neutral; CWSP expects you to map WLAN requirements to confidentiality, integrity, and accountability outcomes rather than to a single product SKU. Operational check: confirm clinical SSIDs require enterprise authentication, encrypt with current WPA2/WPA3 suites, ship AAA and controller logs to central retention, and sample a tablet session to verify it never lands on guest or open segments.