CPHIMS CPHIMS Healthcare Privacy and Security 3 — Questions and Answers
Question 1: Which encryption standard is currently recommended by NIST for protecting data at rest in healthcare systems?
- DES (56-bit)
- 3DES (112-bit)
- AES-128 or AES-256 (Correct answer)
- RC4 stream cipher
Correct answer: AES-128 or AES-256
NIST recommends AES-128 or AES-256 for encrypting data at rest; older standards like DES and 3DES are considered deprecated due to known vulnerabilities.
Question 2: A hospital's risk analysis reveals a high-probability, high-impact threat. According to HIPAA Security Rule, what is the appropriate next step?
- Document the risk and revisit it during the next annual review
- Implement risk management measures to reduce the risk to an acceptable level (Correct answer)
- Immediately report the finding to HHS
- Notify all patients whose data may be affected
Correct answer: Implement risk management measures to reduce the risk to an acceptable level
The HIPAA Security Rule requires covered entities to implement risk management measures to reduce identified risks and vulnerabilities to a reasonable and appropriate level.
Question 3: What does 'audit logging' primarily provide in a healthcare information security context?
- Encryption of data in transit
- A record of who accessed or modified patient data and when (Correct answer)
- Automatic blocking of unauthorized access attempts
- Backup copies of all patient records
Correct answer: A record of who accessed or modified patient data and when
Audit logs create a chronological record of system activity including user access, data modifications, and login attempts, supporting accountability and forensic investigations.
Question 4: Which HIPAA rule specifically governs the technical, physical, and administrative safeguards for electronic PHI?
- HIPAA Privacy Rule
- HIPAA Security Rule (Correct answer)
- HIPAA Breach Notification Rule
- HIPAA Enforcement Rule
Correct answer: HIPAA Security Rule
The HIPAA Security Rule establishes national standards for protecting electronic PHI through administrative, physical, and technical safeguards.
Question 5: A phishing email tricks a hospital employee into revealing their EHR login credentials. Which type of attack does this represent?
- Denial of Service (DoS)
- SQL injection
- Social engineering (Correct answer)
- Man-in-the-middle attack
Correct answer: Social engineering
Phishing is a form of social engineering that manipulates users into disclosing sensitive information by impersonating a trusted source.
Question 6: Under HIPAA, which of the following is a required implementation specification (not addressable) under the Technical Safeguards?
- Encryption of data at rest
- Automatic logoff
- Encryption and decryption of ePHI
- Audit controls (Correct answer)
Correct answer: Audit controls
Audit controls are a required implementation specification under the HIPAA Security Rule's Technical Safeguards, meaning covered entities must implement them regardless of cost or feasibility.
Question 7: What is the minimum necessary standard under HIPAA Privacy Rule?
- Only the minimum number of staff may access PHI
- Covered entities must make reasonable efforts to limit PHI use to what is needed for the intended purpose (Correct answer)
- PHI must be encrypted using the minimum required key length
- Patients must provide minimum documentation to request records
Correct answer: Covered entities must make reasonable efforts to limit PHI use to what is needed for the intended purpose
The minimum necessary standard requires covered entities to make reasonable efforts to limit the use, disclosure, and requests for PHI to the minimum necessary to accomplish the intended purpose.
CPHIMS CPHIMS Healthcare Privacy and Security 3
Which encryption standard is currently recommended by NIST for protecting data at rest in healthcare systems?