CHISSP CHISSP Healthcare Information Security & Risk Management 3

Question 1

Which security control type BEST describes a healthcare organization's Acceptable Use Policy (AUP) for EHR access?

Accepted Answer

Preventive administrative control

Answer

An AUP is an administrative control because it is a policy/procedure, and it is preventive because it is designed to stop misuse before it occurs.

Question 2

When assessing third-party vendor risk in healthcare, what document legally binds a business associate to HIPAA security requirements?

Accepted Answer

Business Associate Agreement (BAA)

Answer

A Business Associate Agreement (BAA) is the legally required contract under HIPAA that obligates vendors handling ePHI to comply with applicable Security and Privacy Rule provisions.

Question 3

A healthcare CISO must prioritize remediation across 50 vulnerabilities. Which methodology provides the MOST systematic approach?

Accepted Answer

Risk-based prioritization using CVSS scores combined with asset criticality

Answer

Combining CVSS severity scores with asset criticality (e.g., whether the asset stores ePHI) provides a risk-adjusted prioritization that focuses resources where harm is greatest.

Question 4

What is the MINIMUM content required in a HIPAA-compliant security incident response plan?

Accepted Answer

Procedures to identify, respond to, and document security incidents involving ePHI

Answer

HIPAA §164.308(a)(6) requires policies and procedures to address security incidents, specifically identification, response, mitigation, documentation, and reporting.

Question 5

Which quantitative risk metric expresses the expected monetary loss from a threat occurring ONCE in a given year?

Accepted Answer

Annualized Loss Expectancy (ALE)

Answer

ALE = SLE × ARO and represents the average expected annual financial loss from a specific threat, used to justify security investment.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP CHISSP Healthcare Information Security & Risk Management 3