CEC Privacy and Security Standards 5

Question 1

Which of the following is an example of a 'social engineering' attack that enrollment counselors should be trained to recognize?

Accepted Answer

A caller claiming to be a government official and requesting an applicant's SSN

Answer

Social engineering involves manipulating individuals into divulging confidential information by impersonating trusted authorities.

Question 2

When disposing of paper records containing applicant PII, enrollment counselors must:

Accepted Answer

Shred or otherwise render the documents unreadable before disposal

Answer

Documents containing PII must be destroyed in a manner that makes the information unreadable, such as cross-cut shredding, to prevent unauthorized access.

Question 3

The HITECH Act strengthened HIPAA by:

Accepted Answer

Extending HIPAA privacy and security obligations to business associates and increasing breach penalties

Answer

HITECH directly subjected business associates to HIPAA requirements and significantly increased civil and criminal penalties for violations.

Question 4

A phishing email sent to an enrollment counselor's work account asks them to click a link and log in to 'verify their credentials.' The counselor should:

Accepted Answer

Delete the email and report it to the IT security team

Answer

Phishing emails should never be clicked on; they should be deleted and reported so the IT team can investigate and protect other users.

Question 5

Which of the following scenarios represents an appropriate use of an applicant's email address collected during enrollment?

Accepted Answer

Sending enrollment confirmation and plan-related notifications

Answer

Email addresses collected during enrollment may only be used for purposes directly related to the enrollment process, such as sending confirmations.

(CEC) Certified Enrollment Counselor Practice Test

(CEC) Certified Enrollment Counselor Practice Test

CEC Privacy and Security Standards 5