CHPS Certified in Healthcare Privacy and Security MCQ 3

Question 1

A healthcare organization shares ePHI with a cloud storage vendor. Under HIPAA, the vendor is BEST classified as a:

Accepted Answer

Business associate

Answer

A cloud vendor that creates, receives, maintains, or transmits ePHI on behalf of a covered entity is a business associate and must sign a Business Associate Agreement (BAA).

Question 2

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals of an unsecured PHI breach within:

Accepted Answer

60 days of discovery

Answer

Covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach.

Question 3

Which cryptographic control renders ePHI unusable, unreadable, or indecipherable to unauthorized individuals and can exempt a breach from notification requirements?

Accepted Answer

NIST-compliant encryption

Answer

NIST-compliant encryption (following HHS guidance referencing NIST SP 800-111 for data at rest) renders PHI unreadable and qualifies as a safe harbor under the Breach Notification Rule.

Question 4

An organization implements automatic session timeouts for workstations accessing ePHI. This is an example of which HIPAA Security Rule safeguard category?

Accepted Answer

Technical safeguard

Answer

Automatic logoff is explicitly listed as an addressable implementation specification under the Access Control technical safeguard in the HIPAA Security Rule.

Question 5

A patient requests an amendment to their medical record because they believe it contains an error. The covered entity denies the request. What must the covered entity provide?

Accepted Answer

Written denial and the right to submit a statement of disagreement

Answer

When a covered entity denies an amendment request, it must provide a written denial and inform the individual of the right to submit a statement of disagreement to be included in the record.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Certified in Healthcare Privacy and Security MCQ 3