CPHIMS CPHIMS Healthcare Privacy and Security 3

Question 1

Which encryption standard is currently recommended by NIST for protecting data at rest in healthcare systems?

Accepted Answer

AES-128 or AES-256

Answer

NIST recommends AES-128 or AES-256 for encrypting data at rest; older standards like DES and 3DES are considered deprecated due to known vulnerabilities.

Question 2

A hospital's risk analysis reveals a high-probability, high-impact threat. According to HIPAA Security Rule, what is the appropriate next step?

Accepted Answer

Implement risk management measures to reduce the risk to an acceptable level

Answer

The HIPAA Security Rule requires covered entities to implement risk management measures to reduce identified risks and vulnerabilities to a reasonable and appropriate level.

Question 3

What does 'audit logging' primarily provide in a healthcare information security context?

Accepted Answer

A record of who accessed or modified patient data and when

Answer

Audit logs create a chronological record of system activity including user access, data modifications, and login attempts, supporting accountability and forensic investigations.

Question 4

Which HIPAA rule specifically governs the technical, physical, and administrative safeguards for electronic PHI?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule establishes national standards for protecting electronic PHI through administrative, physical, and technical safeguards.

Question 5

A phishing email tricks a hospital employee into revealing their EHR login credentials. Which type of attack does this represent?

Accepted Answer

Social engineering

Answer

Phishing is a form of social engineering that manipulates users into disclosing sensitive information by impersonating a trusted source.

CPHIMS Exam Practice Test

CPHIMS Exam Practice Test

CPHIMS CPHIMS Healthcare Privacy and Security 3