CHPS Certified in Healthcare Privacy and Security 4

Question 1

Under the HITECH Act, which entities became directly liable for compliance with certain HIPAA Privacy and Security Rule provisions?

Accepted Answer

Business associates

Answer

The HITECH Act extended direct liability for HIPAA compliance to business associates, making them independently subject to enforcement.

Question 2

A hospital's Security Officer is conducting a risk analysis. Which NIST document provides the most comprehensive guidance for conducting a risk assessment?

Accepted Answer

NIST SP 800-30

Answer

NIST SP 800-30 is the Guide for Conducting Risk Assessments and provides a structured framework for identifying and evaluating information security risks.

Question 3

What is the goal of 'de-identification' of PHI under HIPAA?

Accepted Answer

To remove identifiers so the information cannot reasonably identify an individual

Answer

De-identification removes or obscures the 18 HIPAA-specified identifiers so that the remaining data cannot reasonably be used to identify an individual.

Question 4

Which of the following is a required implementation specification under the HIPAA Security Rule's Administrative Safeguards?

Accepted Answer

Workforce training and management

Answer

Workforce training and management, including security awareness training, is a required implementation specification within the Administrative Safeguards of the HIPAA Security Rule.

Question 5

A covered entity discloses PHI to a public health authority to prevent the spread of disease. This is an example of:

Accepted Answer

A permitted disclosure without patient authorization

Answer

HIPAA permits disclosures of PHI to public health authorities for activities such as disease surveillance, investigation, and intervention without requiring patient authorization.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Certified in Healthcare Privacy and Security 4