Free Certified in Healthcare Privacy and Security Questions and Answers

Question 1

Which of the following HIPAA standards would contain the policies and procedures that specify the process for authorizing access to PHI?

Accepted Answer

Access authorization

Answer

Policies and procedures that define the process for granting access to protected health information (PHI) are typically addressed in the "Access Authorization" standard of the Health Insurance Portability and Accountability Act (HIPAA). Access authorization refers to the controls and mechanisms put in place to ensure that only authorized individuals can access PHI.

The Access Authorization standard under HIPAA includes requirements for covered entities (such as healthcare providers, health plans, and healthcare clearinghouses) to implement policies and procedures that govern the granting and revoking of access to PHI. These policies and procedures should specify who can access PHI, under what circumstances, and for what purposes. They also typically outline the processes for reviewing and approving access requests, ensuring appropriate user authentication and authorization, and maintaining audit trails to track access to PHI.

Question 2

Which of the following rules outlines the steps in implementing several policies and processes to safeguard the security of credit, debit, and cash card transactions?

Accepted Answer

Payment Card Industry Data Security Standard (PCD DDS)

Answer

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards established by the major credit card companies (Visa, Mastercard, American Express, Discover, and JCB International) to ensure the protection of cardholder data. PCI DSS specifies a series of policies and procedures that organizations handling credit, debit, and cash card transactions must implement to safeguard cardholder information.

Question 3

No later than 60 days from the date of discovery, written notice of a breach must be sent to each individual.

Accepted Answer

First class mail or e-mail

Answer

According to the HIPAA Breach Notification Rule, covered entities are required to provide written notification to individuals whose protected health information (PHI) has been breached. The notification must be completed without unreasonable delay, but no later than 60 days from the date of discovery of the breach.

Regarding the method of notification, the rule does not specify a particular means of communication. However, it states that covered entities should use the individual's preferred method of contact if that information is available. First-class mail and email are commonly used methods for delivering breach notifications. The choice between these methods depends on the contact information available for the affected individuals and their indicated preferences.

Question 4

What kind of threat is equipment theft?

Accepted Answer

Acts of man

Answer

The theft of equipment is considered an example of a threat known as "acts of man" or "human threats." Acts of man refer to intentional or deliberate actions carried out by individuals that pose a risk to the security and safety of assets, information, or systems.

Question 5

How long after someone passes away does medical information cease to be safeguarded by HIPAA rules and is no longer deemed protected health information?

Accepted Answer

50

Answer

Under the HIPAA Privacy Rule, a deceased person's health information stops being protected health information 50 years after death. The dated options and 'waiver' are distractors—HIPAA defines a fixed 50-year period, not a specific calendar date or a waiver-based condition.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

Free Certified in Healthcare Privacy and Security Questions and Answers