CHPS Healthcare IT and Security Technologies 2

Question 1

Under the 21st Century Cures Act, covered entities and health IT developers must support patient access to health data through which technical standard?

Accepted Answer

HL7 FHIR R4 APIs

Answer

HL7 v2 messaging

Answer

DICOM web services

Answer

X12 EDI transactions

Question 2

What is the primary security concern with healthcare Internet of Medical Things (IoMT) devices?

Accepted Answer

They often run legacy operating systems with limited patching capabilities, creating unmanageable vulnerabilities

Answer

They require expensive proprietary software licenses

Answer

They generate too much data for healthcare networks to handle

Answer

They require physical proximity to patients, increasing infection risk

Question 3

Which network segmentation strategy BEST protects a healthcare organization's clinical systems from a ransomware attack originating on the administrative network?

Accepted Answer

Segmenting clinical systems into a separate VLAN with strict firewall rules controlling inter-segment traffic

Answer

Using the same VLAN for all devices to simplify management

Answer

Blocking all internet access from the entire organization

Answer

Requiring all devices to use VPN for internal access

Question 4

In healthcare cybersecurity, what does the term 'patch management' refer to?

Accepted Answer

The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities

Answer

Managing software licensing agreements for clinical applications

Answer

Creating backup copies of software configurations

Answer

Monitoring network traffic for unusual data patterns

Question 5

A healthcare organization is implementing Multi-Factor Authentication (MFA) for EHR access. Which combination provides the strongest authentication?

Accepted Answer

Password plus a time-based one-time passcode (TOTP) from an authenticator app

Answer

Username and password only

Answer

Password plus a security question

Answer

Two separate passwords from different systems

Question 6

Under the HIPAA Security Rule, which of the following best describes the purpose of 'entity authentication'?

Accepted Answer

Verifying that a person or entity seeking access to ePHI is who they claim to be before granting access

Answer

Verifying the identity of hardware devices connecting to a network

Answer

Authenticating the integrity of ePHI data during transmission

Answer

Verifying that a business associate is HIPAA-compliant before signing a BAA