AHIC Privacy and Security 2

Question 1

Under HIPAA, which of the following is considered a 'business associate' requiring a formal agreement?

Accepted Answer

A billing company that processes PHI on behalf of a covered entity

Answer

A business associate is any entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity, such as a billing company.

Question 2

Which authentication control best mitigates the risk of credential theft in a health informatics environment?

Accepted Answer

Multi-factor authentication (MFA)

Answer

MFA requires multiple verification factors, significantly reducing the risk of unauthorized access even if credentials are stolen.

Question 3

A covered entity discovers a breach affecting 600 individuals. What is the HIPAA notification deadline to the Secretary of HHS?

Accepted Answer

60 days after the end of the calendar year

Answer

Breaches affecting fewer than 500 individuals must be reported to HHS within 60 days after the end of the calendar year in which the breach was discovered.

Question 4

What does the concept of 'minimum necessary' require under the HIPAA Privacy Rule?

Accepted Answer

Access to PHI must be limited to the least amount needed to accomplish the purpose

Answer

The minimum necessary standard requires that PHI be used, disclosed, or requested only to the extent needed to accomplish the intended purpose.

Question 5

Which security framework is most widely referenced for establishing information security controls in U.S. healthcare organizations?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework is widely adopted in U.S. healthcare for structuring security programs around Identify, Protect, Detect, Respond, and Recover functions.

(AHIC) AMIA Health Informatics Certification Practice Test

(AHIC) AMIA Health Informatics Certification Practice Test

AHIC Privacy and Security 2