CHI Risk Management & Mitigation 5

Question 1

A health IT organization is selecting between two risk mitigation controls. Control A costs $50,000 and reduces ALE by $40,000; Control B costs $20,000 and reduces ALE by $35,000. Which control offers better value?

Accepted Answer

Control B, because its net benefit ($15,000) is higher relative to cost

Answer

Control B yields a net benefit of $15,000 ($35k reduction − $20k cost) vs. Control A's net benefit of −$10,000, making Control B the more cost-effective choice.

Question 2

Which activity is part of the MONITOR step in a continuous risk management lifecycle?

Accepted Answer

Tracking control effectiveness and emerging threats over time

Answer

The Monitor step involves ongoing observation of control performance, environmental changes, and new threat intelligence to ensure risk posture remains acceptable.

Question 3

A patient portal suffers a SQL injection attack exposing 600 patients' PHI. Under HIPAA, to which entity must the covered entity report this breach if it affects fewer than 500 individuals in a single state?

Accepted Answer

HHS Office for Civil Rights in the annual summary report

Answer

For breaches affecting fewer than 500 individuals, HIPAA requires reporting to HHS OCR in an annual log submitted no later than 60 days after the end of the calendar year.

Question 4

Which term describes the process of systematically identifying assets, threats, vulnerabilities, and likelihood to calculate overall organizational risk exposure?

Accepted Answer

Risk assessment

Answer

A risk assessment is the structured process of identifying assets, analyzing threats and vulnerabilities, and estimating the likelihood and impact of potential harm.

Question 5

An organization implements multi-factor authentication (MFA) on all remote access to clinical systems. This control primarily addresses which risk scenario?

Accepted Answer

Unauthorized access resulting from compromised user credentials

Answer

MFA adds a second verification factor so that a stolen or guessed password alone cannot grant unauthorized remote access to clinical systems.

(CHI) Certified Health Informatician Practice Test

(CHI) Certified Health Informatician Practice Test

CHI Risk Management & Mitigation 5