Digital Privacy and Security Flashcards
7 cards from real CTP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Digital Privacy and Security flashcards as text
Which authentication method provides the STRONGEST security for telehealth provider portal logins?
Answer: Multi-factor authentication combining a password and a one-time code
Multi-factor authentication (MFA) significantly reduces unauthorized access risk by requiring two or more independent verification factors.
A telehealth provider allows patients to send photos of wounds via SMS text message. What is the MAIN compliance concern with this practice?
Answer: Standard SMS is not encrypted and does not meet HIPAA security requirements for ePHI
Standard SMS messages are transmitted without encryption and lack the access controls required to protect ePHI under HIPAA.
What does 'end-to-end encryption' mean in the context of a telehealth video platform?
Answer: The video data is encrypted on the sender's device and can only be decrypted by the intended recipient
End-to-end encryption ensures that only the communicating parties can decrypt the data, preventing even the service provider from accessing the content.
A patient requests access to their telehealth visit recordings and clinical notes. Under HIPAA, the provider must generally respond within:
Answer: 30 calendar days of receiving the request
HIPAA requires covered entities to act on a patient's request for access to their PHI within 30 calendar days, with one possible 30-day extension.
Which of the following is an example of a 'technical safeguard' required under the HIPAA Security Rule?
Answer: Implementing automatic logoff for inactive telehealth platform sessions
Automatic logoff is a technical safeguard that terminates a session after a period of inactivity to prevent unauthorized access to ePHI.
A telehealth organization's security policy requires a workforce member to verify a patient's identity before each telehealth session. Which security principle does this PRIMARILY address?
Answer: Authentication and identity verification
Verifying patient identity before each session addresses authentication, ensuring that ePHI is disclosed only to the correct individual.
When using a third-party telehealth platform, which action BEST demonstrates appropriate due diligence before sharing patient data?
Answer: Verifying the vendor has signed a BAA and reviewing their security certifications
Executing a BAA and reviewing security certifications verifies the vendor's legal commitment and technical capability to protect ePHI.