Digital Privacy and Security Flashcards
7 cards from real CTP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital Privacy and Security flashcards as text
A telehealth provider wants to use a patient's de-identified data for a quality improvement study. Under HIPAA, which standard must be met for data to qualify as truly de-identified?
Answer: Apply the Safe Harbor method by removing all 18 specified identifiers
HIPAA's Safe Harbor method requires removal of all 18 specified identifiers to consider health data de-identified.
Which encryption standard is currently recommended by NIST for protecting electronic protected health information (ePHI) in transit?
Answer: TLS 1.2 or higher
NIST recommends TLS 1.2 or higher for encrypting ePHI in transit, as older protocols have known vulnerabilities.
A telehealth clinic experiences a ransomware attack that encrypts patient records. What is the FIRST action the security officer should take?
Answer: Isolate affected systems from the network immediately
Isolating affected systems prevents ransomware from spreading to additional systems and is the immediate containment priority.
Under HIPAA, how long must a covered entity retain documentation of its security policies and procedures?
Answer: 6 years from creation or last effective date
HIPAA requires covered entities to retain security documentation for 6 years from the date of creation or the date it was last in effect.
A telehealth platform uses role-based access control (RBAC). Which principle does this BEST support?
Answer: Minimum necessary access
RBAC enforces the minimum necessary principle by granting users only the access required for their specific role.
A patient emails their telehealth provider through a standard unsecured email service requesting medical advice. What is the provider's BEST response?
Answer: Reply only via a HIPAA-compliant secure messaging platform
Providers should transition communication to a HIPAA-compliant secure messaging platform to protect ePHI, regardless of how the patient initiated contact.
What is the purpose of a Business Associate Agreement (BAA) in a telehealth setting?
Answer: It establishes that a vendor handling ePHI is contractually bound to HIPAA safeguards
A BAA is a legally required contract ensuring that vendors who handle ePHI on behalf of a covered entity comply with HIPAA security and privacy rules.