COE IT Management Questions and Answers

Question 1

An ophthalmic practice manager discovers that a technician has been using a personal, unencrypted USB drive to transfer patient diagnostic images between the testing room and a physician's review station.
According to HIPAA incident response protocols, what is the MOST critical and immediate action required?

Accepted Answer

Confiscate the drive, secure the device, and perform a formal risk assessment to determine if a breach of Protected Health Information (PHI) occurred.

Answer

Immediately retrain all staff on the practice's HIPAA policies.

Answer

Report a potential breach to the Department of Health and Human Services (HHS) within 24 hours.

Answer

Draft a notification letter to all potentially affected patients.

Question 2

In the context of IT management for an ophthalmic practice, which of the following best distinguishes a Business Continuity Plan (BCP) from a Disaster Recovery (DR) Plan?

Accepted Answer

A BCP is a comprehensive strategy to keep the entire practice operational during a disruption, whereas a DR plan is a subset of the BCP focused specifically on restoring IT systems and data.

Answer

A BCP focuses only on data backups, while a DR plan covers all business operations.

Answer

A BCP is only necessary for large, multi-location practices, while a DR plan is required for all practices.

Answer

A DR plan outlines how to prevent cyberattacks, while a BCP details how to respond to them.

Question 3

An ophthalmic practice is selecting a new Electronic Health Record (EHR) system. To ensure the practice can successfully participate in the Merit-based Incentive Payment System (MIPS), which of the following is the most critical feature the EHR must possess?

Accepted Answer

Certification from the Office of the National Coordinator for Health Information Technology (ONC-HIT).

Answer

A cloud-based hosting architecture for remote access.

Answer

An integrated patient portal for online scheduling and bill pay.

Answer

A module for managing optical inventory and sales.

Question 4

The practice's front desk coordinator receives an email that appears to be from the lead physician, urgently requesting a password to access a file on the server for a 'telehealth consultation.' This is a classic example of which type of cybersecurity threat?

Accepted Answer

Spear Phishing

Answer

Ransomware

Answer

Denial-of-Service (DoS) Attack

Answer

General Malware

Question 5

A practice is implementing a new OCT device that generates very large image files. To ensure fast and reliable access to these images from all exam rooms and review stations, which network infrastructure component is most critical to evaluate and potentially upgrade?

Accepted Answer

The Local Area Network (LAN), including switches and cabling.

Answer

The practice's internet service provider (ISP) connection speed.

Answer

The antivirus software installed on each workstation.

Answer

The cloud-based data backup service.

Question 6

As mandated by the HIPAA Security Rule, an ophthalmic practice must conduct a periodic Security Risk Analysis (SRA). Which of the following best describes the primary goal of this analysis?

Accepted Answer

To identify and assess potential threats and vulnerabilities to electronic Protected Health Information (ePHI) and implement appropriate safeguards.

Answer

To document all IT hardware and software for asset management and depreciation.

Answer

To test the speed and reliability of the internal network and internet connection.

Answer

To provide a comprehensive training manual for new employees on using the EHR system.