CHPS Healthcare IT and Security Technologies 2 — Questions and Answers
Question 1: Under the 21st Century Cures Act, covered entities and health IT developers must support patient access to health data through which technical standard?
- HL7 v2 messaging
- HL7 FHIR R4 APIs (Correct answer)
- DICOM web services
- X12 EDI transactions
Correct answer: HL7 FHIR R4 APIs
The 21st Century Cures Act requires certified health IT to support FHIR R4-based APIs enabling patients and authorized third parties to access their health data.
Question 2: What is the primary security concern with healthcare Internet of Medical Things (IoMT) devices?
- They require expensive proprietary software licenses
- They often run legacy operating systems with limited patching capabilities, creating unmanageable vulnerabilities (Correct answer)
- They generate too much data for healthcare networks to handle
- They require physical proximity to patients, increasing infection risk
Correct answer: They often run legacy operating systems with limited patching capabilities, creating unmanageable vulnerabilities
IoMT devices often run outdated embedded OS firmware that cannot be patched, creating persistent vulnerabilities that are difficult to remediate in a clinical environment.
Question 3: Which network segmentation strategy BEST protects a healthcare organization's clinical systems from a ransomware attack originating on the administrative network?
- Using the same VLAN for all devices to simplify management
- Segmenting clinical systems into a separate VLAN with strict firewall rules controlling inter-segment traffic (Correct answer)
- Blocking all internet access from the entire organization
- Requiring all devices to use VPN for internal access
Correct answer: Segmenting clinical systems into a separate VLAN with strict firewall rules controlling inter-segment traffic
Network segmentation isolates clinical systems from administrative networks, containing ransomware spread and protecting patient-facing systems from attacks originating elsewhere.
Question 4: In healthcare cybersecurity, what does the term 'patch management' refer to?
- Managing software licensing agreements for clinical applications
- The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities (Correct answer)
- Creating backup copies of software configurations
- Monitoring network traffic for unusual data patterns
Correct answer: The systematic process of identifying, acquiring, testing, and deploying software updates to fix vulnerabilities
Patch management is the structured process of keeping software current with security and functional updates to remediate known vulnerabilities before they are exploited.
Question 5: A healthcare organization is implementing Multi-Factor Authentication (MFA) for EHR access. Which combination provides the strongest authentication?
- Username and password only
- Password plus a security question
- Password plus a time-based one-time passcode (TOTP) from an authenticator app (Correct answer)
- Two separate passwords from different systems
Correct answer: Password plus a time-based one-time passcode (TOTP) from an authenticator app
Combining something you know (password) with something you have (TOTP from an authenticator app) provides true multi-factor authentication using distinct factor categories.
Question 6: Under the HIPAA Security Rule, which of the following best describes the purpose of 'entity authentication'?
- Verifying the identity of hardware devices connecting to a network
- Verifying that a person or entity seeking access to ePHI is who they claim to be before granting access (Correct answer)
- Authenticating the integrity of ePHI data during transmission
- Verifying that a business associate is HIPAA-compliant before signing a BAA
Correct answer: Verifying that a person or entity seeking access to ePHI is who they claim to be before granting access
Entity authentication (45 CFR §164.312(d)) requires covered entities to verify the identity of any person or entity seeking access to ePHI before granting access.
CHPS Healthcare IT and Security Technologies 2
Under the 21st Century Cures Act, covered entities and health IT developers must support patient access to health data through which technical standard?