CHPS Privacy Program Management 3

Question 1

A healthcare system's Privacy Officer is reviewing third-party vendor relationships. Which of the following vendors requires a Business Associate Agreement?

Accepted Answer

A medical transcription company that transcribes physician notes containing PHI

Answer

A cleaning company that accesses patient care areas but not patient records

Answer

A law firm providing legal advice to the organization regarding HIPAA compliance

Answer

A cloud storage vendor that maintains backups of encrypted ePHI where only the covered entity holds the decryption keys

Question 2

In healthcare privacy program management, what is the purpose of conducting periodic privacy audits?

Accepted Answer

To verify ongoing compliance with privacy policies, identify gaps, and drive continuous improvement

Answer

To generate reports for public disclosure on the organization's website

Answer

To satisfy state licensing requirements for hospital accreditation

Answer

To replace the annual privacy training requirement

Question 3

Which of the following is a key privacy consideration when implementing a Health Information Exchange (HIE)?

Accepted Answer

Establishing governance agreements that address consent models, data use limitations, and break-the-glass procedures

Answer

Ensuring all participating organizations use the same EHR system

Answer

Requiring all patients to opt in to all HIE data sharing by default

Answer

Restricting HIE access to only primary care providers

Question 4

Under HIPAA, what must a covered entity do if it maintains PHI about deceased individuals?

Accepted Answer

Maintain HIPAA protections for PHI of deceased individuals for 50 years after death

Answer

Immediately destroy all PHI upon a patient's death

Answer

PHI of deceased individuals loses HIPAA protection immediately upon death

Answer

Disclose PHI of deceased individuals freely since privacy rights end at death

Question 5

When designing a privacy compliance monitoring program, which approach provides the strongest ongoing assurance?

Accepted Answer

Periodic random audits combined with automated access log monitoring and incident trend analysis

Answer

Annual self-attestation by department heads

Answer

Relying solely on patient complaints as a proxy for compliance failures

Answer

Conducting a comprehensive audit only when OCR requests one

Question 6

A hospital's privacy program is undergoing an external assessment. Which standard would be MOST appropriate for benchmarking privacy program maturity in a US healthcare context?

Accepted Answer

NIST Privacy Framework (PF)

Answer

GDPR compliance checklist

Answer

PCI DSS controls

Answer

SOC 2 Type II criteria