Certified Healthcare Information Systems Security Practitioner (C)HISSP) — Questions and Answers

Question 1: Which documentation & health records practice is MOST critical for maintaining data integrity in Certified Healthcare Information Systems Security Practitioner?

Manual data entry without verification
Storing data in multiple disconnected systems
Allowing unrestricted access to modify records
Standardized input procedures with validation checks and regular audits (Correct answer)

Correct answer: Standardized input procedures with validation checks and regular audits

Standardized procedures with validation and audits ensure data remains accurate, consistent, and trustworthy.

Question 2: Which of the following is a key security concern unique to legacy medical devices that cannot be patched or updated?

They do not support HL7 FHIR communication standards
They often run outdated operating systems with unmitigated vulnerabilities (Correct answer)
They require more bandwidth than modern devices
They are incompatible with DHCP-assigned addressing

Correct answer: They often run outdated operating systems with unmitigated vulnerabilities

Many legacy medical devices run end-of-life operating systems (e.g., Windows XP) that cannot receive security patches, leaving known vulnerabilities permanently unmitigated.

Question 3: What is the PRIMARY objective of anatomy & physiology fundamentals within the Certified Healthcare Information Systems Security Practitioner profession?

To limit the scope of professional activities
To ensure quality outcomes through standardized practices and continuous improvement (Correct answer)
To create additional requirements for practitioners
To maintain the status quo without change

Correct answer: To ensure quality outcomes through standardized practices and continuous improvement

The primary objective is ensuring quality outcomes through established standards while continuously improving practices and processes.

Question 4: What is the primary purpose of the HIPAA Privacy Rule's 'minimum necessary' standard as it applies to workforce members accessing ePHI?

Prevent any workforce access to PHI without patient consent
Ensure all workforce members have equal access to PHI
Limit access to only the PHI needed to accomplish the intended purpose (Correct answer)
Require PHI to be stored in the minimum number of systems

Correct answer: Limit access to only the PHI needed to accomplish the intended purpose

The minimum necessary standard requires covered entities to limit PHI access within the workforce to those who need it and to the amount required to perform their job functions.

Question 5: Which technology allows a healthcare organization to verify the integrity of network devices and endpoints before granting them access to clinical resources?

Network Access Control (NAC) (Correct answer)
Content Delivery Network (CDN)
Network Address Translation (NAT)
Dynamic Host Configuration Protocol (DHCP) reservations

Correct answer: Network Access Control (NAC)

NAC evaluates device health — patch status, antivirus, configuration compliance — before permitting connection, preventing non-compliant endpoints from accessing sensitive clinical resources.

Question 6: Which factor BEST indicates mastery of pharmacology & treatment protocols in Certified Healthcare Information Systems Security Practitioner?

The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Speed of task completion
Number of certifications held
Years of experience in a single setting

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 7: How should documentation & health records retention policies be determined in Certified Healthcare Information Systems Security Practitioner?

Destroying records as soon as they are no longer immediately needed
Keeping everything indefinitely
Based on available storage space
Based on legal requirements, operational needs, and industry best practices (Correct answer)

Correct answer: Based on legal requirements, operational needs, and industry best practices

Retention policies should balance legal requirements, operational needs, and best practices to ensure appropriate preservation and disposal.

Question 8: Under HIPAA's Minimum Necessary standard, when must a covered entity apply this requirement?

For all disclosures including those for treatment purposes between providers
Only when disclosing PHI to business associates
When using or disclosing PHI for any purpose other than treatment (Correct answer)
Only for disclosures to law enforcement

Correct answer: When using or disclosing PHI for any purpose other than treatment

The Minimum Necessary standard applies to all uses and disclosures except treatment purposes, patient requests, disclosures required by law, and disclosures to HHS.

Question 9: A healthcare organization classifies a threat as having HIGH likelihood and LOW impact. Which risk treatment action is MOST appropriate?

Avoid by discontinuing the system
Immediately remediate
Monitor and accept (Correct answer)
Transfer via cyber insurance

Correct answer: Monitor and accept

High likelihood/low impact risks generally fall into an acceptable risk zone that warrants monitoring rather than costly immediate remediation.

Question 10: In Certified Healthcare Information Systems Security Practitioner, how does anatomy & physiology fundamentals contribute to professional credibility?

By using impressive terminology
By avoiding challenging situations
Through the number of years in practice alone
By demonstrating competence, maintaining standards, and delivering consistent results (Correct answer)

Correct answer: By demonstrating competence, maintaining standards, and delivering consistent results

Professional credibility is built through demonstrated competence, consistent adherence to standards, and reliable delivery of quality results.

Question 11: Which federal agency is primarily responsible for enforcing HIPAA Privacy and Security Rules?

Federal Trade Commission (FTC)
Department of Justice (DOJ)
HHS Office for Civil Rights (OCR) (Correct answer)
Centers for Medicare & Medicaid Services (CMS)

Correct answer: HHS Office for Civil Rights (OCR)

HHS OCR is the primary HIPAA enforcement agency, investigating complaints, conducting audits, and imposing civil monetary penalties for Privacy and Security Rule violations.

Question 12: Which factor BEST indicates mastery of anatomy & physiology fundamentals in Certified Healthcare Information Systems Security Practitioner?

Years of experience in a single setting
Speed of task completion
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Number of certifications held

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 13: Which asset classification level typically applies to electronic Protected Health Information (ePHI) in a US healthcare organization?

Internal Use Only
Sensitive but Unclassified
Restricted / Highly Confidential (Correct answer)
Public

Correct answer: Restricted / Highly Confidential

ePHI is classified at the highest confidentiality level because unauthorized disclosure triggers HIPAA breach notification and significant legal penalties.

Question 14: A healthcare CISO must prioritize remediation across 50 vulnerabilities. Which methodology provides the MOST systematic approach?

Remediating all vulnerabilities in alphabetical order by CVE ID
Risk-based prioritization using CVSS scores combined with asset criticality (Correct answer)
Patching only vulnerabilities reported in HHS breach data
Addressing vulnerabilities based on vendor patch release date

Correct answer: Risk-based prioritization using CVSS scores combined with asset criticality

Combining CVSS severity scores with asset criticality (e.g., whether the asset stores ePHI) provides a risk-adjusted prioritization that focuses resources where harm is greatest.

Question 15: Which HITECH provision extended direct HIPAA Security Rule obligations to business associates?

Section 13401 of HITECH, which made Security Rule provisions directly applicable to business associates (Correct answer)
The HIPAA Omnibus Rule of 2013 exclusively
CMS Conditions of Participation regulations
The original HIPAA statute of 1996

Correct answer: Section 13401 of HITECH, which made Security Rule provisions directly applicable to business associates

HITECH §13401 made business associates directly liable for compliance with the HIPAA Security Rule's administrative, physical, and technical safeguards, enforceable by HHS OCR.

Question 16: Under the HIPAA Breach Notification Rule, what is the deadline for notifying affected individuals after discovery of a breach affecting fewer than 500 patients?

Within 60 days of breach discovery
Within 60 days of end of the calendar year in which the breach was discovered (Correct answer)
Within 30 days of breach discovery
Within 90 days of breach discovery

Correct answer: Within 60 days of end of the calendar year in which the breach was discovered

For breaches affecting fewer than 500 individuals, covered entities must notify affected patients within 60 days of the end of the calendar year, though prompt notification is encouraged.

Question 17: When conducting a quality improvement & patient safety review in Certified Healthcare Information Systems Security Practitioner, which approach yields the BEST results?

Reviewing only incidents from the past month
Focusing exclusively on equipment checks
Informal observation without documentation
Systematic analysis using established frameworks and checklists (Correct answer)

Correct answer: Systematic analysis using established frameworks and checklists

Systematic analysis using established frameworks ensures comprehensive coverage of all potential risks and provides consistent, reliable results.

Question 18: Which action BEST demonstrates a commitment to professional ethics & legal standards in Certified Healthcare Information Systems Security Practitioner?

Relying on colleagues to interpret regulatory requirements
Following only the regulations that are convenient
Maintaining current knowledge of all applicable regulations and standards (Correct answer)
Addressing compliance issues only when audited

Correct answer: Maintaining current knowledge of all applicable regulations and standards

Actively maintaining current knowledge of applicable regulations demonstrates genuine commitment to compliance and helps prevent violations.

Question 19: When assessing third-party vendor risk in healthcare, what document legally binds a business associate to HIPAA security requirements?

Business Associate Agreement (BAA) (Correct answer)
Memorandum of Understanding (MOU)
Service Level Agreement (SLA)
Non-Disclosure Agreement (NDA)

Correct answer: Business Associate Agreement (BAA)

A Business Associate Agreement (BAA) is the legally required contract under HIPAA that obligates vendors handling ePHI to comply with applicable Security and Privacy Rule provisions.

Question 20: Which factor MOST impacts the usefulness of documentation & health records outputs in Certified Healthcare Information Systems Security Practitioner?

Timeliness, accuracy, and relevance to the intended audience (Correct answer)
Format and visual presentation only
Complexity of the analysis
Volume of data collected

Correct answer: Timeliness, accuracy, and relevance to the intended audience

Information is most useful when it is timely, accurate, and relevant to the needs of the people who will use it.

Question 21: Which risk management framework is most commonly adopted by US healthcare organizations to align information security with regulatory requirements?

ISO/IEC 27001
COBIT 5
NIST Cybersecurity Framework (Correct answer)
PCI DSS

Correct answer: NIST Cybersecurity Framework

The NIST Cybersecurity Framework is widely adopted by US healthcare organizations because it aligns with HIPAA Security Rule requirements and provides a flexible, risk-based approach.

Question 22: A healthcare network administrator needs to monitor traffic between a biomedical device network and the clinical LAN. Which tool is MOST appropriate?

Network-based IDS (NIDS) with a span/mirror port on the inter-segment switch (Correct answer)
A proxy server handling all inter-segment HTTP traffic
Host-based antivirus on each medical device
Intrusion Detection System (IDS) placed inline between segments

Correct answer: Network-based IDS (NIDS) with a span/mirror port on the inter-segment switch

A NIDS with a span port passively monitors traffic between segments without impacting device performance or availability, which is critical for time-sensitive biomedical devices.

Question 23: How many of the 18 HIPAA-defined identifiers must be removed from patient data for it to qualify as 'de-identified' under the Safe Harbor method?

Name, DOB, SSN, and address are sufficient
All 18 identifiers must be removed (Correct answer)
At least 15 of the 18 identifiers
Only the 5 most identifying elements

Correct answer: All 18 identifiers must be removed

The Safe Harbor de-identification method under §164.514(b) requires removal of all 18 specified identifiers and verification that no residual information could identify the individual.

Question 24: Under HIPAA, which category of organizations is directly regulated as a 'covered entity'?

Health IT vendors and EHR software developers
Employers who sponsor self-insured health plans exclusively
Healthcare providers, health plans, and healthcare clearinghouses (Correct answer)
Medical device manufacturers and pharmaceutical companies

Correct answer: Healthcare providers, health plans, and healthcare clearinghouses

HIPAA's three categories of covered entities are healthcare providers who transmit health information electronically, health plans, and healthcare clearinghouses.

Question 25: Which authentication mechanism provides the strongest security for remote access to a healthcare organization's clinical systems?

Single sign-on with a shared administrative account
Biometric fingerprint authentication alone
Multi-factor authentication combining something you know and something you have (Correct answer)
Username and password with complexity requirements

Correct answer: Multi-factor authentication combining something you know and something you have

Multi-factor authentication requiring two different credential types (e.g., password plus a hardware token) significantly reduces the risk of unauthorized access even if one factor is compromised.

Question 26: A nurse's workstation automatically logs out after 3 minutes of inactivity. Which security principle does this automatic timeout BEST enforce?

Non-repudiation
Session management and unauthorized access prevention (Correct answer)
Audit logging and accountability
Data integrity

Correct answer: Session management and unauthorized access prevention

Automatic session timeout prevents unauthorized individuals from accessing a logged-in workstation left unattended, directly addressing the risk of session hijacking and unauthorized access.

Question 27: Under HIPAA, which of the following is NOT considered Protected Health Information (PHI)?

Oral communications about a patient's diagnosis
Medical records in paper format
Electronic billing records containing diagnosis codes
De-identified health information with all 18 identifiers removed (Correct answer)

Correct answer: De-identified health information with all 18 identifiers removed

Once health information is properly de-identified using HIPAA's Safe Harbor or Expert Determination methods, it no longer meets the definition of PHI and is not subject to HIPAA protections.

Question 28: What is the MINIMUM content required in a HIPAA-compliant security incident response plan?

Contact information for all healthcare regulators in the US
A list of every possible cyberattack and its remediation steps
A quarterly schedule for penetration testing activities
Procedures to identify, respond to, and document security incidents involving ePHI (Correct answer)

Correct answer: Procedures to identify, respond to, and document security incidents involving ePHI

HIPAA §164.308(a)(6) requires policies and procedures to address security incidents, specifically identification, response, mitigation, documentation, and reporting.

Question 29: Which concept describes the maximum tolerable period that a healthcare system can be offline before unacceptable patient care harm occurs?

Recovery Point Objective (RPO)
Maximum Tolerable Downtime (MTD) (Correct answer)
Mean Time to Repair (MTTR)
Recovery Time Objective (RTO)

Correct answer: Maximum Tolerable Downtime (MTD)

Maximum Tolerable Downtime (MTD) is the absolute upper limit of outage duration beyond which the organization cannot recover or patient harm becomes unacceptable.

Question 30: What is the primary purpose of a Healthcare Risk Analysis (HRA) under the HIPAA Security Rule?

To assess the financial impact of a data breach
To audit employee access logs for unauthorized activity
To document physical security controls for server rooms
To identify and evaluate risks to the confidentiality, integrity, and availability of ePHI (Correct answer)

Correct answer: To identify and evaluate risks to the confidentiality, integrity, and availability of ePHI

HIPAA's Security Rule §164.308(a)(1) requires covered entities to conduct an accurate and thorough assessment of potential risks to ePHI as the foundation of their security program.

Question 31: Which factor BEST indicates mastery of emergency response & critical care in Certified Healthcare Information Systems Security Practitioner?

Speed of task completion
Years of experience in a single setting
Number of certifications held
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Certified Healthcare Information Systems Security Practitioner (C)HISSP)

The C)HISSP certification by Mile2 validates a practitioner's ability to secure healthcare information systems, covering HIPAA compliance, healthcare IT network security, risk management, and protection of patient health data.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds