CHPS Certified in Healthcare Privacy and Security 3

Question 1

Which HIPAA standard requires covered entities to have written contracts with business associates before sharing PHI?

Accepted Answer

Business Associate Agreement (BAA)

Answer

A Business Associate Agreement (BAA) is the HIPAA-required written contract that establishes the permitted uses and disclosures of PHI by a business associate.

Question 2

Under the HIPAA minimum necessary standard, which of the following disclosures is exempt?

Accepted Answer

Disclosures to the individual who is the subject of the PHI

Answer

The minimum necessary standard does not apply to disclosures made to the individual who is the subject of the PHI.

Question 3

What is 'shoulder surfing' in the context of healthcare information security?

Accepted Answer

Observing someone's screen or keyboard to steal credentials or PHI

Answer

Shoulder surfing is a social engineering technique where an attacker physically observes a user's screen or keystrokes to obtain sensitive information.

Question 4

An organization implements full-disk encryption on all laptops. Under HIPAA's Breach Notification Rule, if an encrypted laptop is stolen, the organization should:

Accepted Answer

Not report it as a breach if the encryption meets HHS guidance

Answer

Data encrypted in accordance with HHS guidance is considered 'unusable, unreadable, or indecipherable' and therefore its loss does not constitute a reportable breach.

Question 5

Which of the following is an example of a physical safeguard required by the HIPAA Security Rule?

Accepted Answer

Workstation use policies and physical access controls to facilities

Answer

Physical safeguards include facility access controls, workstation use policies, and device and media controls to protect electronic PHI from physical threats.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Certified in Healthcare Privacy and Security 3