CPCA Compliance and Auditing 5 — Questions and Answers
Question 1: A compliance officer at a healthcare organization receives a request from law enforcement for patient records without a court order. What should the officer do first?
- Immediately provide all requested records to cooperate with authorities
- Consult legal counsel before releasing any patient information (Correct answer)
- Deny the request outright as it violates HIPAA
- Notify the affected patients before responding
Correct answer: Consult legal counsel before releasing any patient information
Before releasing any protected health information, the compliance officer should consult with legal counsel to determine whether the request meets HIPAA's permissible disclosure requirements.
Question 2: During an audit, a CPCA discovers that a vendor with access to sensitive data has not signed a Business Associate Agreement (BAA). Under which regulation is this a violation?
- FERPA
- HIPAA (Correct answer)
- GLBA
- SOX
Correct answer: HIPAA
Under HIPAA, covered entities must have a signed Business Associate Agreement with any vendor that creates, receives, maintains, or transmits protected health information on their behalf.
Question 3: Which metric is most useful for tracking the effectiveness of a compliance remediation program over time?
- Total number of employees trained on security awareness
- Mean time to remediate (MTTR) identified compliance findings (Correct answer)
- Number of third-party vendors onboarded per quarter
- Total IT budget allocated to compliance activities
Correct answer: Mean time to remediate (MTTR) identified compliance findings
Mean time to remediate (MTTR) measures how quickly an organization resolves identified compliance findings, directly reflecting the effectiveness of the remediation process.
Question 4: An auditor reviews an organization's change management process and finds that changes are being implemented without formal approval. Which ITIL process is being violated?
- Incident Management
- Problem Management
- Change Management (Correct answer)
- Service Level Management
Correct answer: Change Management
Change Management requires formal approval through a Change Advisory Board (CAB) or similar process before implementing changes to production systems.
Question 5: What is the purpose of a compliance risk register?
- To record all employee disciplinary actions related to policy violations
- To document, prioritize, and track identified compliance risks and their mitigation status (Correct answer)
- To store copies of all regulatory correspondence received by the organization
- To list all third-party vendors and their contractual obligations
Correct answer: To document, prioritize, and track identified compliance risks and their mitigation status
A compliance risk register is a structured document that captures identified compliance risks, their likelihood and impact, assigned owners, and the status of mitigation efforts.
Question 6: Under the NIST Cybersecurity Framework (CSF), which function focuses on identifying, investigating, and containing a cybersecurity event?
- Identify
- Protect
- Detect
- Respond (Correct answer)
Correct answer: Respond
The Respond function of the NIST CSF covers activities to take action regarding a detected cybersecurity incident, including containment, eradication, and communication.
Question 7: A CPCA is conducting a third-party vendor risk assessment. Which factor is most critical to evaluate when the vendor processes regulated data?
- The vendor's geographic location and time zone
- The vendor's own compliance certifications and audit reports (e.g., SOC 2, ISO 27001) (Correct answer)
- The vendor's annual revenue and financial stability
- The number of years the vendor has been in business
Correct answer: The vendor's own compliance certifications and audit reports (e.g., SOC 2, ISO 27001)
When a vendor processes regulated data, their compliance certifications and independent audit reports (such as SOC 2 or ISO 27001) are the most direct evidence of their security and compliance controls.
CPCA Compliance and Auditing 5
A compliance officer at a healthcare organization receives a request from law enforcement for patient records without a court order.
What should the officer do first?