CHI Risk Management & Mitigation 4

Question 1

Which metric represents the estimated monetary loss from a single successful threat event?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

SLE is calculated as Asset Value × Exposure Factor and represents the expected loss from one occurrence of a specific threat.

Question 2

During a tabletop exercise, a health system simulates a ransomware attack on its clinical systems. What is the primary goal of this exercise?

Accepted Answer

To evaluate staff and leadership response without disrupting live systems

Answer

Tabletop exercises are discussion-based scenarios designed to test decision-making and response coordination without impacting production environments.

Question 3

A Business Associate Agreement (BAA) is best described as:

Accepted Answer

A legal contract requiring a vendor with PHI access to comply with applicable HIPAA safeguards

Answer

A BAA is a required contractual agreement that obligates business associates to appropriately safeguard PHI and report breaches, but does not transfer all liability from the covered entity.

Question 4

Which of the following is the MOST effective control to mitigate the risk of insider threats to PHI?

Accepted Answer

Implementing role-based access control with least privilege

Answer

Role-based access control with least privilege limits users to only the PHI they need for their job, directly reducing the scope of potential insider misuse.

Question 5

An organization's Risk Appetite Statement indicates it will tolerate Low risks without further action. A newly identified risk is scored as Medium. What is the required next step?

Accepted Answer

Escalate to senior leadership and select a risk treatment option

Answer

When identified risk exceeds the defined risk appetite, it must be escalated and a treatment option (mitigate, transfer, avoid, or formally accept with rationale) must be selected.

(CHI) Certified Health Informatician Practice Test

(CHI) Certified Health Informatician Practice Test

CHI Risk Management & Mitigation 4