Practice Test Geeks(CTP) Certified Telehealth Practitioner Practice Test
← All CTP Flashcard Decks

Digital Privacy and Security Flashcards

7 cards from real CTP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Digital Privacy and Security flashcards as text

  1. A telehealth practice discovers that a former employee's access credentials were never deactivated after termination. This is a failure of which HIPAA safeguard category?

    Answer: Administrative safeguards

    Establishing and following workforce clearance procedures, including timely access termination, is an administrative safeguard requirement under HIPAA.

  2. Which of the following BEST describes 'data at rest' in a telehealth environment?

    Answer: ePHI stored on servers, databases, or backup media when not actively in use

    Data at rest refers to ePHI stored on any medium — servers, hard drives, or backups — that is not currently being transmitted.

  3. A telehealth provider conducts sessions from a home office where family members may overhear conversations. The MOST appropriate mitigation is:

    Answer: Using a private, dedicated space with a door and conducting sessions with headphones

    A private, closed space with headphones limits incidental disclosures to household members, satisfying HIPAA's reasonable safeguards requirement.

  4. What is the key difference between a HIPAA 'privacy' violation and a HIPAA 'security' violation?

    Answer: Privacy relates to improper use or disclosure of PHI; security relates specifically to failures protecting ePHI

    The Privacy Rule governs all PHI (any format), while the Security Rule specifically applies to electronic PHI (ePHI) and its technical, administrative, and physical protections.

  5. A patient in a telehealth session uses an unsecured public Wi-Fi network. Which risk does this PRIMARILY introduce?

    Answer: Potential interception of session data by third parties on the same network

    Public Wi-Fi networks lack encryption controls, making session data vulnerable to interception by other users on the same network.

  6. Under HIPAA, which of the following is NOT considered a required implementation specification of the Security Rule's Access Control standard?

    Answer: Biometric authentication for all users

    Biometric authentication is not a required HIPAA specification; unique user IDs, emergency access procedures, and automatic logoff are required or addressable specifications.

  7. A covered telehealth entity experiences a breach affecting 600 patients in Texas. In addition to notifying HHS and affected individuals, what additional notification is required?

    Answer: Notify prominent media outlets in the state because more than 500 residents are affected

    HIPAA requires notification to prominent media outlets when a breach affects more than 500 residents of a state or jurisdiction.