Digital Privacy and Security Flashcards
7 cards from real CTP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital Privacy and Security flashcards as text
A telehealth provider uses a personal smartphone for patient video visits without any mobile device management (MDM) software. Which risk does this PRIMARILY create?
Answer: Inability to enforce remote wipe if the device is lost or stolen
Without MDM, there is no mechanism to remotely wipe ePHI from a lost or stolen personal device, creating a significant breach risk.
Which of the following BEST describes a 'man-in-the-middle' (MITM) attack in a telehealth context?
Answer: An attacker intercepts and potentially alters communications between a patient and provider
In a MITM attack, an attacker secretly intercepts and can alter communications between two parties who believe they are communicating directly.
A telehealth organization is evaluating a new EHR vendor. Which security document should the organization request FIRST to assess the vendor's security posture?
Answer: A SOC 2 Type II audit report
A SOC 2 Type II report provides an independent auditor's assessment of a vendor's security controls over a defined period of time.
Under the HIPAA Breach Notification Rule, what is the maximum time a covered entity has to notify the Secretary of HHS of a breach affecting 500 or more individuals?
Answer: 60 calendar days from discovery
For breaches affecting 500 or more individuals, HHS must be notified within 60 calendar days of discovery of the breach.
A telehealth session is recorded with patient consent. Where should this recording be stored to remain HIPAA compliant?
Answer: In a HIPAA-compliant cloud storage solution with a signed BAA
Recordings containing ePHI must be stored in a HIPAA-compliant cloud environment where the vendor has signed a BAA.
What is the PRIMARY goal of conducting a HIPAA Security Risk Analysis (SRA)?
Answer: To identify, assess, and document potential risks and vulnerabilities to ePHI
The SRA is designed to systematically identify threats and vulnerabilities to ePHI so that appropriate safeguards can be implemented.
A provider accidentally sends a patient's therapy notes to the wrong patient via a secure portal. This is BEST categorized as:
Answer: A HIPAA privacy breach requiring breach notification analysis
Misdirected disclosure of ePHI to the wrong patient constitutes a potential breach and must undergo a four-factor breach notification analysis.