CPHIMS CPHIMS Healthcare Privacy and Security 2

Question 1

Under HIPAA, which of the following is NOT considered protected health information (PHI)?

Accepted Answer

De-identified health data meeting Safe Harbor standards

Answer

De-identified health data that meets HIPAA's Safe Harbor or Expert Determination standards is not considered PHI and is not subject to HIPAA protections.

Question 2

A healthcare organization experiences a ransomware attack that encrypts patient records. Under HIPAA Breach Notification Rule, when must affected individuals be notified?

Accepted Answer

Within 60 days of discovery

Answer

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach.

Question 3

Which NIST framework component focuses on recovering systems and services after a cybersecurity incident?

Accepted Answer

Recover

Answer

The NIST Cybersecurity Framework 'Recover' function focuses on restoring capabilities and services impaired by a cybersecurity incident.

Question 4

An employee accesses patient records of a celebrity out of curiosity without a treatment purpose. This is an example of which type of HIPAA violation?

Accepted Answer

Unauthorized access (snooping)

Answer

Accessing patient records without a legitimate treatment, payment, or operations purpose is considered unauthorized access or 'snooping,' a serious HIPAA violation.

Question 5

What is the primary purpose of a Business Associate Agreement (BAA) under HIPAA?

Accepted Answer

To ensure vendors safeguard PHI they access on behalf of a covered entity

Answer

A BAA is a contract that requires business associates to appropriately safeguard PHI they create, receive, maintain, or transmit on behalf of a covered entity.

CPHIMS Exam Practice Test

CPHIMS Exam Practice Test

CPHIMS CPHIMS Healthcare Privacy and Security 2