Privacy and Security Standards Flashcards
7 cards from real CEC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy and Security Standards flashcards as text
Which of the following is an example of a 'social engineering' attack that enrollment counselors should be trained to recognize?
Answer: A caller claiming to be a government official and requesting an applicant's SSN
Social engineering involves manipulating individuals into divulging confidential information by impersonating trusted authorities.
When disposing of paper records containing applicant PII, enrollment counselors must:
Answer: Shred or otherwise render the documents unreadable before disposal
Documents containing PII must be destroyed in a manner that makes the information unreadable, such as cross-cut shredding, to prevent unauthorized access.
The HITECH Act strengthened HIPAA by:
Answer: Extending HIPAA privacy and security obligations to business associates and increasing breach penalties
HITECH directly subjected business associates to HIPAA requirements and significantly increased civil and criminal penalties for violations.
A phishing email sent to an enrollment counselor's work account asks them to click a link and log in to 'verify their credentials.' The counselor should:
Answer: Delete the email and report it to the IT security team
Phishing emails should never be clicked on; they should be deleted and reported so the IT team can investigate and protect other users.
Which of the following scenarios represents an appropriate use of an applicant's email address collected during enrollment?
Answer: Sending enrollment confirmation and plan-related notifications
Email addresses collected during enrollment may only be used for purposes directly related to the enrollment process, such as sending confirmations.
What is the significance of the 'right to amend' under HIPAA for enrollment applicants?
Answer: Applicants may request corrections to inaccurate PHI in their records
The right to amend allows individuals to request corrections to inaccurate or incomplete PHI held by a covered entity.
An enrollment counselor finishes assisting an applicant at a shared workstation. What should the counselor do before leaving?
Answer: Log out of all systems and clear any cached applicant data
Logging out and clearing session data on shared workstations prevents unauthorized access to applicant information by subsequent users.