CCS Security Principles and Practices 4

Question 1

A healthcare organization must ensure patient data remains accessible during a system outage. Which element of the CIA triad does this address?

Accepted Answer

Availability

Answer

Confidentiality

Answer

Integrity

Answer

Authentication

Question 2

What is the role of a Privacy Officer in a healthcare organization?

Accepted Answer

Developing and implementing HIPAA privacy policies and handling complaints

Answer

Managing the IT infrastructure and network security

Answer

Conducting medical coding audits for compliance

Answer

Authorizing all external disclosures of patient records

Question 3

Which of the following is an example of a 'technical safeguard' under the HIPAA Security Rule?

Accepted Answer

Implementing multi-factor authentication for EHR access

Answer

Training staff on phishing awareness

Answer

Installing deadbolt locks on server room doors

Answer

Shredding paper records containing PHI

Question 4

A patient asks a hospital not to disclose their mental health treatment to their adult children. Under HIPAA, the hospital should:

Accepted Answer

Honor the restriction request as long as the patient pays out of pocket for that service

Answer

Disclose because family members have a right to know

Answer

Deny the request because family notification is always required

Answer

Notify only the primary care physician of the restriction

Question 5

Social engineering in the context of healthcare information security refers to:

Accepted Answer

Manipulating people into revealing confidential information or granting unauthorized access

Answer

Using software to automate coding workflows

Answer

Organizing patient data into structured social networks

Answer

A method of encrypting social media data

Question 6

Which HIPAA rule requires covered entities to notify patients when their unsecured PHI has been improperly disclosed?

Accepted Answer

The Breach Notification Rule

Answer

The Privacy Rule

Answer

The Security Rule

Answer

The Enforcement Rule

Question 7

A coding specialist accidentally sends a fax containing patient information to the wrong number. This is best categorized as:

Accepted Answer

An impermissible disclosure that must be assessed as a potential breach

Answer

An intentional HIPAA violation

Answer

An incidental disclosure requiring no action

Answer

A permissible disclosure under treatment purposes