CPHIMS Healthcare Privacy and Security Questions and Answers — Questions and Answers
Question 1: A hospital contracts with a third-party cloud storage provider to archive its electronic health records (EHR). The provider guarantees the data will be encrypted at rest. Under HIPAA, what is the most critical document the hospital must have in place with this vendor before transferring any Protected Health Information (PHI)?
- Service Level Agreement (SLA)
- Business Associate Agreement (BAA) (Correct answer)
- Non-Disclosure Agreement (NDA)
- Data Use Agreement (DUA)
Correct answer: Business Associate Agreement (BAA)
A Business Associate Agreement (BAA) is a contract required by HIPAA between a covered entity and a business associate. It establishes the vendor's responsibility to protect PHI in accordance with HIPAA guidelines. While an SLA, NDA, or DUA may also be used, the BAA is the specific, legally mandated contract for this relationship.
Question 2: A healthcare organization is discovered to have had a breach of its electronic health record system where the unencrypted PHI of over 600 patients was acquired by an unauthorized party. According to the HIPAA Breach Notification Rule, which of the following MUST be notified?
- The affected individuals and the FBI
- The affected individuals, the Secretary of HHS (via OCR), and prominent media outlets (Correct answer)
- The Secretary of HHS (via OCR) and the organization's cyber liability insurance carrier
- The affected individuals and the local police department only
Correct answer: The affected individuals, the Secretary of HHS (via OCR), and prominent media outlets
The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay (and within 60 days). For breaches affecting more than 500 individuals in a state or jurisdiction, the entity must also notify the Secretary of Health and Human Services (HHS) and prominent media outlets serving that area.
Question 3: A health system's security policy states that a user's access rights and permissions to systems containing ePHI should be limited to only what is strictly required to perform their job responsibilities. What security principle does this policy enforce?
- Defense in Depth
- Security through Obscurity
- Separation of Duties
- Least Privilege Principle (Correct answer)
Correct answer: Least Privilege Principle
The Principle of Least Privilege dictates that a user should be given only the minimum levels of access—or permissions—needed to perform their job functions. This is a fundamental concept in information security designed to limit the potential damage from a compromised account or insider threat.
Question 4: A data center that houses servers for a multi-hospital health system implements security guards, badge-controlled access doors, and video surveillance. These measures are primarily examples of which category of safeguards required by the HIPAA Security Rule?
- Technical Safeguards
- Administrative Safeguards
- Physical Safeguards (Correct answer)
- Procedural Safeguards
Correct answer: Physical Safeguards
Physical Safeguards are the physical measures, policies, and procedures to protect electronic information systems and related buildings and equipment from natural hazards and unauthorized intrusion. Facility access controls like guards, badges, and surveillance fall directly under this category.
Question 5: According to the HIPAA Security Rule, which of the following is the foundational and first step an organization must take when developing its security compliance program?
- Provide security awareness training to all employees
- Encrypt all electronic protected health information (ePHI)
- Conduct a security risk analysis (Correct answer)
- Implement access control policies
Correct answer: Conduct a security risk analysis
The HIPAA Security Rule mandates that a covered entity must first conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. This risk analysis is foundational, as it informs all other security decisions and safeguard implementations.
Question 6: A healthcare organization requires all laptops containing electronic Protected Health Information (ePHI) to use full-disk encryption. Under the HIPAA Security Rule, this measure is an example of which type of safeguard?
- Administrative Safeguard
- Physical Safeguard
- Organizational Safeguard
- Technical Safeguard (Correct answer)
Correct answer: Technical Safeguard
Technical Safeguards are the technology and related policies for its use that protect ePHI and control access to it. Encryption is a specific implementation specification under the Technical Safeguards standard used to protect data at rest and in transit.
CPHIMS Healthcare Privacy and Security Questions and Answers
A hospital contracts with a third-party cloud storage provider to archive its electronic health records (EHR).
The provider guarantees the data will be encrypted at rest.
Under HIPAA, what is the most critical document the hospital must have in place with this vendor before transferring any Protected Health Information (PHI)?