eAIS study plan

Map each element of a security governance program (policies, standards, procedures, oversight bodies) to a concrete eHealth example such as a hospital EHR steering committee

Distinguish qualitative, quantitative, and hybrid risk assessment methods and justify which fits a clinical system with patient-safety impact

Draft a risk register with at least eight entries using likelihood, impact, and treatment options (mitigate, transfer, avoid, accept)

Identify the compliance obligations that intersect with security governance in eHealth, including audit evidence retention and third-party/vendor risk review

Compare the core principles of health information privacy law: purpose limitation, minimum necessary, consent, and patient access rights

Classify data types (identifiable, de-identified, pseudonymized, aggregated) and state which obligations survive each transformation

Explain lawful bases and exceptions for secondary use of health data in research, public health reporting, and quality measurement

Describe breach notification triggers, timelines, and the roles of controller/covered entity versus processor/business associate

Differentiate authentication factors and select an appropriate assurance level for clinicians, administrators, and patients

Design a role-based access model for an EHR with at least five roles and separation-of-duties constraints

Evaluate federated identity patterns (SAML, OIDC) and multi-factor options for clinical single sign-on

Describe lifecycle controls for provisioning, de-provisioning, and periodic access recertification

Segment a clinical network into zones (medical devices, clinical workstations, administrative, guest) with defined traffic rules

Select controls for protecting legacy and unpatched medical devices that cannot run endpoint agents

Explain remote access and third-party connectivity safeguards including VPN, jump hosts, and session monitoring

Identify logging and network detection sources needed for clinical environment visibility

Apply secure software lifecycle practices to a health application, including threat modeling at design and security testing before release

Distinguish encryption at rest, in transit, and in use, and choose appropriate algorithms and key lengths for each

Describe key management lifecycle tasks: generation, storage, rotation, escrow, and destruction

Compare secure exchange mechanisms for health data such as encrypted messaging, API gateways, and standards-based interchange, noting integrity and non-repudiation properties

Define detection use cases relevant to healthcare, such as anomalous record access, mass export, and after-hours login spikes

Outline incident response phases and assign responsibilities for a suspected health data breach

Specify evidence handling and forensic preservation steps that do not disrupt clinical care

Draft post-incident review criteria that feed corrective actions back into risk management

Set recovery objectives (RTO and RPO) for clinical, imaging, and administrative systems based on care criticality

Design a backup strategy covering frequency, retention, immutability, and offsite copies for ransomware resilience

Plan downtime procedures that let clinicians continue care when systems are unavailable

Schedule and document a restoration test with acceptance criteria

Assess security risks introduced by connected medical devices, telehealth platforms, and AI-assisted clinical tools

Design a workforce security awareness program with measurable phishing and reporting metrics

Revisit weak domains from earlier weeks and close gaps with targeted review

Complete timed practice sets across all domains and analyze error patterns by domain