CHP CHP Business Associates & Vendor Management 2

Question 1

Under the HIPAA Security Rule, the primary purpose of a risk analysis is to:

Accepted Answer

Identify potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI

Answer

A risk analysis identifies potential threats and vulnerabilities to the confidentiality, integrity, and availability of ePHI as required by the HIPAA Security Rule.

Question 2

How often must a covered entity perform a HIPAA Security Rule risk analysis?

Accepted Answer

Periodically and whenever there are significant environmental or operational changes

Answer

HIPAA requires risk analyses to be conducted periodically and whenever significant changes occur in the environment, operations, or technology.

Question 3

What must follow a completed HIPAA risk analysis?

Accepted Answer

Implementation of a risk management plan addressing identified risks

Answer

A risk analysis must be followed by a risk management plan that prioritizes and addresses the identified risks to ePHI.

Question 4

When evaluating a cloud service provider to handle ePHI, which factor is most critical from a HIPAA compliance standpoint?

Accepted Answer

Whether the provider will sign a BAA and demonstrates HIPAA compliance

Answer

Any cloud service provider that handles ePHI must be willing to enter a BAA and demonstrate the ability to comply with HIPAA requirements.

Question 5

How does the HIPAA 'minimum necessary' standard apply to business associates?

Accepted Answer

Business associates must limit PHI access to only what is needed to perform their contracted function

Answer

Business associates must restrict their use and disclosure of PHI to the minimum necessary to fulfill their contracted obligations.

(CHP) Certified HIPAA Professional Practice Test

(CHP) Certified HIPAA Professional Practice Test

CHP CHP Business Associates & Vendor Management 2