Privacy and Security Standards Flashcards
7 cards from real CEC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy and Security Standards flashcards as text
A Certified Enrollment Counselor discovers a colleague is accessing applicant files out of curiosity, not for work purposes. The counselor should:
Answer: Report it to a supervisor or compliance officer
Unauthorized access to applicant records is a privacy violation that must be reported through proper compliance channels.
Which of the following best describes a 'Business Associate Agreement' (BAA) under HIPAA?
Answer: A written agreement ensuring vendors protect PHI appropriately
A BAA is a contract requiring business associates who handle PHI to safeguard it in compliance with HIPAA rules.
Which type of security safeguard involves using physical measures such as locks, badge readers, and security cameras to protect data?
Answer: Physical safeguards
Physical safeguards under HIPAA include physical measures, policies, and procedures to protect electronic information systems and related buildings from unauthorized access.
An enrollment counselor is helping an applicant over the phone. Before discussing account details, the counselor should:
Answer: Verify the applicant's identity using security questions or a PIN
Identity verification before disclosing account information prevents unauthorized disclosure to impostors.
Under the ACA Marketplace rules, which of the following is a permitted use of applicant data collected during enrollment?
Answer: Using it to determine eligibility for coverage and financial assistance
Applicant data collected through Marketplace enrollment may only be used for purposes directly related to determining eligibility and enrollment.
Which encryption standard is commonly recommended for protecting data transmitted over the internet in healthcare enrollment systems?
Answer: TLS (Transport Layer Security)
TLS encrypts data in transit and is the standard protocol for securing sensitive information transmitted over the internet.
If an applicant withdraws their consent to share data with a third-party assister, the enrollment counselor must:
Answer: Stop sharing the applicant's data with that third party immediately
Consent can be revoked at any time, and data sharing must cease promptly upon withdrawal of consent.