CEC Privacy and Security Standards 4 — Questions and Answers
Question 1: What is the primary purpose of a Notice of Privacy Practices (NPP) in healthcare enrollment?
- To describe the plan's premium costs and benefits
- To inform individuals how their health information may be used and disclosed (Correct answer)
- To serve as an enrollment confirmation form
- To outline the counselor's commission structure
Correct answer: To inform individuals how their health information may be used and disclosed
An NPP informs individuals of their privacy rights and how covered entities may use or disclose their protected health information.
Question 2: Multi-factor authentication (MFA) in enrollment systems provides security by:
- Requiring multiple supervisors to approve each enrollment
- Verifying identity using two or more independent credentials (Correct answer)
- Allowing multiple users to share a single login
- Encrypting data at multiple storage locations
Correct answer: Verifying identity using two or more independent credentials
MFA requires users to provide two or more verification factors, significantly reducing the risk of unauthorized account access.
Question 3: An applicant's income information collected for APTC eligibility may NOT be shared with:
- The Marketplace to determine eligibility
- A commercial lender without the applicant's consent (Correct answer)
- The IRS for tax credit reconciliation
- State Medicaid agencies for joint eligibility determination
Correct answer: A commercial lender without the applicant's consent
Income data collected for Marketplace eligibility determinations cannot be shared with commercial lenders, as that falls outside the permitted uses of enrollment data.
Question 4: Which of the following actions violates the principle of 'data minimization' during enrollment?
- Collecting only the SSNs of household members needed for eligibility
- Recording an applicant's favorite hobbies for a future marketing campaign (Correct answer)
- Asking for household size to determine subsidy eligibility
- Verifying citizenship status as required for enrollment
Correct answer: Recording an applicant's favorite hobbies for a future marketing campaign
Data minimization requires collecting only what is necessary for the specific purpose; collecting personal data for marketing violates this principle.
Question 5: A counselor's work laptop is stolen. What is the FIRST step the counselor should take?
- Purchase a replacement laptop immediately
- Report the theft to their supervisor and IT/security team promptly (Correct answer)
- Wait to see if the laptop is recovered before reporting
- Only report if the laptop contained more than 500 records
Correct answer: Report the theft to their supervisor and IT/security team promptly
Immediately reporting device theft allows the security team to remotely wipe the device and begin breach assessment procedures.
Question 6: Under HIPAA Security Rule, which of the following is an example of a technical safeguard?
- Training staff on privacy policies
- Installing automatic logoff on workstations after inactivity (Correct answer)
- Conducting annual security risk assessments
- Locking server room doors
Correct answer: Installing automatic logoff on workstations after inactivity
Automatic logoff is a technical safeguard that prevents unauthorized access to systems left unattended.
Question 7: An individual asks to inspect their enrollment records. Under applicable privacy rules, the covered entity must respond:
- Within 5 business days
- Within 30 days, with a possible 30-day extension (Correct answer)
- Within 60 days, no extensions allowed
- Only after the individual provides written authorization from a lawyer
Correct answer: Within 30 days, with a possible 30-day extension
HIPAA requires covered entities to provide access to records within 30 days, with one 30-day extension allowed if needed.
CEC Privacy and Security Standards 4
What is the primary purpose of a Notice of Privacy Practices (NPP) in healthcare enrollment?