CHSA Security & Risk Management 2

Question 1

Under the HIPAA Security Rule, which type of safeguard includes conducting a risk analysis and designating a security official?

Accepted Answer

Administrative safeguards

Answer

Risk analysis, risk management, and assigning security responsibility are required administrative safeguards under 45 CFR 164.308.

Question 2

A facility wants to identify how a new medication-dispensing process might fail before it goes live. Which tool is most appropriate?

Accepted Answer

Failure mode and effects analysis (FMEA)

Answer

FMEA is a proactive tool that identifies potential failure modes and their effects before harm occurs.

Question 3

Under the HIPAA Breach Notification Rule, a breach affecting 500 or more residents of a state requires notification to whom in addition to affected individuals and HHS?

Accepted Answer

Prominent media outlets serving the state

Answer

Breaches involving more than 500 residents of a state or jurisdiction require notice to prominent media outlets serving that area.

Question 4

Which risk management strategy is used when an organization purchases professional liability insurance?

Accepted Answer

Risk transfer

Answer

Buying insurance shifts the financial consequences of a loss to a third party, which is risk transfer.

Question 5

Which encryption-related statement about ePHI under the HIPAA Security Rule is correct?

Accepted Answer

Encryption is an addressable implementation specification

Answer

Encryption is addressable, meaning the entity must implement it or document why an equivalent alternative is reasonable and appropriate.

CHSA - Certified Health Service Administrator Practice Test

CHSA - Certified Health Service Administrator Practice Test

CHSA Security & Risk Management 2