CHPS Healthcare Information Security Controls 2

Question 1

Which of the following best describes the concept of 'integrity' in the context of the HIPAA Security Rule?

Accepted Answer

Protecting ePHI from improper alteration or destruction

Answer

Ensuring ePHI is accessible to authorized users when needed

Answer

Restricting ePHI access to only authorized workforce members

Answer

Encrypting ePHI during transmission over open networks

Question 2

Under the HIPAA Security Rule, what must a covered entity do when it terminates a workforce member's employment?

Accepted Answer

Implement a termination procedure that includes removal of system access

Answer

Only notify the Privacy Officer of the termination

Answer

Archive the employee's ePHI access logs for 6 years

Answer

Submit a workforce change notification to HHS

Question 3

A healthcare organization uses a cloud-based EHR. Under HIPAA, which type of agreement must be in place with the cloud provider?

Accepted Answer

Business Associate Agreement (BAA)

Answer

Service Level Agreement (SLA)

Answer

Data Governance Agreement (DGA)

Answer

Non-Disclosure Agreement (NDA)

Question 4

Under the HIPAA Security Rule, 'audit controls' are best described as:

Accepted Answer

Hardware, software, or procedural mechanisms that record and examine activity in systems containing ePHI

Answer

Policies governing who may access ePHI workstations

Answer

Encryption standards applied to ePHI in transit

Answer

Physical locks and badges controlling server room entry

Question 5

Which of the following encryption standards is generally accepted for protecting ePHI in transit under HIPAA Security Rule guidance?

Accepted Answer

TLS 1.2 or higher

Answer

SSL 2.0

Answer

TLS 1.0

Answer

MD5 hashing

Question 6

What is the key difference between the HIPAA Privacy Rule and the HIPAA Security Rule?

Accepted Answer

The Privacy Rule covers all PHI in any form; the Security Rule covers only electronic PHI (ePHI)

Answer

The Privacy Rule applies only to hospitals; the Security Rule applies to all covered entities

Answer

The Privacy Rule is voluntary; the Security Rule is mandatory

Answer

The Privacy Rule is enforced by ONC; the Security Rule is enforced by OCR