CHISSP CHISSP Healthcare Information Security & Risk Management 2

Question 1

Which asset classification level typically applies to electronic Protected Health Information (ePHI) in a US healthcare organization?

Accepted Answer

Restricted / Highly Confidential

Answer

ePHI is classified at the highest confidentiality level because unauthorized disclosure triggers HIPAA breach notification and significant legal penalties.

Question 2

A security analyst discovers that a business associate is storing ePHI without encryption on portable media. Which HIPAA safeguard has been violated?

Accepted Answer

Technical safeguards — encryption and decryption standard

Answer

HIPAA §164.312(a)(2)(iv) addresses encryption and decryption as an addressable technical safeguard for ePHI on portable media.

Question 3

In a healthcare threat model, which threat actor is statistically responsible for the MOST healthcare data breaches according to HHS breach reports?

Accepted Answer

Insider threats (workforce members)

Answer

HHS breach portal data consistently shows that insider threats — including accidental disclosures and intentional snooping by workforce members — account for the largest share of healthcare breaches.

Question 4

What is the PRIMARY goal of a Business Impact Analysis (BIA) in a healthcare information security program?

Accepted Answer

Identify critical systems and quantify the operational impact of their disruption

Answer

A BIA identifies critical business processes, the systems supporting them, and the financial/operational impact of downtime, informing recovery time and recovery point objectives.

Question 5

Which concept describes the maximum tolerable period that a healthcare system can be offline before unacceptable patient care harm occurs?

Accepted Answer

Maximum Tolerable Downtime (MTD)

Answer

Maximum Tolerable Downtime (MTD) is the absolute upper limit of outage duration beyond which the organization cannot recover or patient harm becomes unacceptable.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP CHISSP Healthcare Information Security & Risk Management 2