CHISSP CHISSP Healthcare Information Security & Risk Management

Question 1

Which risk management framework is most commonly adopted by US healthcare organizations to align information security with regulatory requirements?

Accepted Answer

NIST Cybersecurity Framework

Answer

The NIST Cybersecurity Framework is widely adopted by US healthcare organizations because it aligns with HIPAA Security Rule requirements and provides a flexible, risk-based approach.

Question 2

What is the primary purpose of a Healthcare Risk Analysis (HRA) under the HIPAA Security Rule?

Accepted Answer

To identify and evaluate risks to the confidentiality, integrity, and availability of ePHI

Answer

HIPAA's Security Rule §164.308(a)(1) requires covered entities to conduct an accurate and thorough assessment of potential risks to ePHI as the foundation of their security program.

Question 3

A healthcare organization classifies a threat as having HIGH likelihood and LOW impact. Which risk treatment action is MOST appropriate?

Accepted Answer

Monitor and accept

Answer

High likelihood/low impact risks generally fall into an acceptable risk zone that warrants monitoring rather than costly immediate remediation.

Question 4

Which of the following BEST describes residual risk in healthcare information security?

Accepted Answer

Risk remaining after controls have been applied

Answer

Residual risk is the level of risk that remains after security controls and countermeasures have been implemented, which must be accepted by management.

Question 5

Under the HIPAA Security Rule, which type of safeguard covers workforce training and security management policies?

Accepted Answer

Administrative safeguards

Answer

Administrative safeguards under §164.308 include policies, procedures, workforce training, and security management processes that govern how ePHI is protected.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP CHISSP Healthcare Information Security & Risk Management