CCS Security Principles and Practices 3 — Questions and Answers
Question 1: A coding specialist working remotely accesses patient records over public Wi-Fi without a VPN. This violates which HIPAA Security Rule requirement?
- Workforce training requirements
- Transmission security safeguards for ePHI (Correct answer)
- Physical safeguards for workstation use
- Contingency plan requirements
Correct answer: Transmission security safeguards for ePHI
HIPAA transmission security standards require encryption or equivalent measures when ePHI is transmitted over open networks to prevent unauthorized interception.
Question 2: Which of the following represents a physical safeguard under the HIPAA Security Rule?
- Password complexity requirements
- Automatic logoff from workstations after inactivity
- Locked server rooms with key card access (Correct answer)
- Encryption of data at rest
Correct answer: Locked server rooms with key card access
Physical safeguards control physical access to facilities and equipment where ePHI is stored or accessed, such as locked rooms with controlled entry.
Question 3: A patient requests an amendment to their medical record because they believe it contains an error. Under HIPAA, the covered entity must:
- Immediately make the requested change
- Accept or deny the request within 60 days, with a possible 30-day extension (Correct answer)
- Refer the patient to their physician and take no action
- Deny all amendment requests to maintain record integrity
Correct answer: Accept or deny the request within 60 days, with a possible 30-day extension
HIPAA gives covered entities 60 days to respond to amendment requests, with the option to extend by 30 days if they provide written notice.
Question 4: Which type of malware specifically encrypts an organization's files and demands payment for the decryption key?
- Spyware
- Adware
- Ransomware (Correct answer)
- Trojan horse
Correct answer: Ransomware
Ransomware encrypts victim files or systems and demands a ransom payment, often in cryptocurrency, for the decryption key.
Question 5: A coder realizes she has been documenting under a colleague's login credentials for two weeks. This situation violates which core security principle?
- Data redundancy
- Non-repudiation and individual accountability (Correct answer)
- Data minimization
- Role-based access control alignment
Correct answer: Non-repudiation and individual accountability
Sharing login credentials undermines non-repudiation and individual accountability, making it impossible to attribute specific actions to the correct user.
Question 6: Under the HIPAA Minimum Necessary Rule, which scenario is most appropriate?
- A coder accesses the full psychiatric notes to code a routine fracture repair
- A biller accesses only the claim-related diagnosis and procedure codes needed for billing (Correct answer)
- A receptionist views all lab results to verify patient identity
- A physician reviews all records for every patient in the practice daily
Correct answer: A biller accesses only the claim-related diagnosis and procedure codes needed for billing
The minimum necessary standard requires that access to PHI be limited to the specific information required to complete the task at hand.
Question 7: Which federal law specifically addresses the electronic exchange of health information and established nationwide standards for health data security?
- HITECH Act
- Sarbanes-Oxley Act
- HIPAA of 1996 (Correct answer)
- Gramm-Leach-Bliley Act
Correct answer: HIPAA of 1996
HIPAA of 1996 established the foundational national standards for protecting health information privacy and security in electronic transactions.
CCS Security Principles and Practices 3
A coding specialist working remotely accesses patient records over public Wi-Fi without a VPN.
This violates which HIPAA Security Rule requirement?