CHI Risk Management & Mitigation 2

Question 1

Which risk treatment option involves transferring financial exposure to a third party, such as a cyber insurance policy?

Accepted Answer

Risk transference

Answer

Risk transference shifts financial liability to another party, commonly through cyber liability insurance or contractual indemnification clauses.

Question 2

A healthcare organization conducts a Business Impact Analysis (BIA). What is the primary output of this process?

Accepted Answer

Recovery Time Objectives and critical business function rankings

Answer

A BIA identifies critical business functions and establishes Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) to prioritize recovery efforts.

Question 3

Under HIPAA, a covered entity must report a breach to affected individuals within how many days of discovery?

Accepted Answer

60 days

Answer

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach.

Question 4

Which framework provides a structured set of controls specifically designed for managing information security risk in healthcare organizations?

Accepted Answer

NIST SP 800-66

Answer

NIST SP 800-66 is an implementation guide for HIPAA Security Rule compliance, mapping NIST controls to healthcare security requirements.

Question 5

A risk register entry shows a vulnerability with High likelihood and Low impact. What is the appropriate prioritization relative to a Low likelihood, High impact entry?

Accepted Answer

They typically receive similar priority; context determines precedence

Answer

Risk scoring multiplies likelihood by impact, so both scenarios can yield similar risk scores; organizational context and risk appetite determine final prioritization.

(CHI) Certified Health Informatician Practice Test

(CHI) Certified Health Informatician Practice Test

CHI Risk Management & Mitigation 2