CHI Risk Management & Mitigation 3

Question 1

A hospital's EHR vendor experiences a ransomware attack that disrupts patient record access. Which risk category best describes this event?

Accepted Answer

Third-party / supply chain risk

Answer

When a vendor's security failure causes disruption to a covered entity, it represents third-party or supply chain risk, highlighting the importance of Business Associate Agreements.

Question 2

In health informatics, what is the purpose of a Data Flow Diagram (DFD) during a risk assessment?

Accepted Answer

To map how PHI moves between systems, processes, and external entities

Answer

DFDs identify all points where PHI is created, stored, transmitted, or destroyed, enabling risk assessors to uncover exposure points across data flows.

Question 3

Which security concept ensures that PHI cannot be altered or destroyed in an unauthorized manner?

Accepted Answer

Integrity

Answer

Integrity, one of the three HIPAA Security Rule principles, ensures that electronic PHI is not improperly modified or deleted.

Question 4

An organization decides to discontinue a high-risk legacy system with no feasible control options. Which risk strategy is being employed?

Accepted Answer

Risk avoidance

Answer

Risk avoidance eliminates the risk entirely by discontinuing the activity, system, or process that creates the exposure.

Question 5

Which role is primarily responsible for ensuring a risk management program aligns with organizational strategy and approving risk tolerance levels?

Accepted Answer

Board of Directors or Senior Leadership

Answer

Risk tolerance and enterprise-wide risk appetite decisions must be set and approved by senior leadership or the board, as they reflect organizational strategy.

(CHI) Certified Health Informatician Practice Test

(CHI) Certified Health Informatician Practice Test

CHI Risk Management & Mitigation 3