CPHIMS Healthcare Privacy and Security Questions and Answers

Question 1

A hospital contracts with a third-party cloud storage provider to archive its electronic health records (EHR).
The provider guarantees the data will be encrypted at rest.
Under HIPAA, what is the most critical document the hospital must have in place with this vendor before transferring any Protected Health Information (PHI)?

Accepted Answer

Business Associate Agreement (BAA)

Answer

Service Level Agreement (SLA)

Answer

Non-Disclosure Agreement (NDA)

Answer

Data Use Agreement (DUA)

Question 2

A healthcare organization is discovered to have had a breach of its electronic health record system where the unencrypted PHI of over 600 patients was acquired by an unauthorized party. According to the HIPAA Breach Notification Rule, which of the following MUST be notified?

Accepted Answer

The affected individuals, the Secretary of HHS (via OCR), and prominent media outlets

Answer

The affected individuals and the FBI

Answer

The Secretary of HHS (via OCR) and the organization's cyber liability insurance carrier

Answer

The affected individuals and the local police department only

Question 3

A health system's security policy states that a user's access rights and permissions to systems containing ePHI should be limited to only what is strictly required to perform their job responsibilities. What security principle does this policy enforce?

Accepted Answer

Least Privilege Principle

Answer

Defense in Depth

Answer

Security through Obscurity

Answer

Separation of Duties

Question 4

A data center that houses servers for a multi-hospital health system implements security guards, badge-controlled access doors, and video surveillance. These measures are primarily examples of which category of safeguards required by the HIPAA Security Rule?

Accepted Answer

Physical Safeguards

Answer

Technical Safeguards

Answer

Administrative Safeguards

Answer

Procedural Safeguards

Question 5

According to the HIPAA Security Rule, which of the following is the foundational and first step an organization must take when developing its security compliance program?

Accepted Answer

Conduct a security risk analysis

Answer

Provide security awareness training to all employees

Answer

Encrypt all electronic protected health information (ePHI)

Answer

Implement access control policies

Question 6

A healthcare organization requires all laptops containing electronic Protected Health Information (ePHI) to use full-disk encryption. Under the HIPAA Security Rule, this measure is an example of which type of safeguard?

Accepted Answer

Technical Safeguard

Answer

Administrative Safeguard

Answer

Physical Safeguard

Answer

Organizational Safeguard