CTP Digital Privacy and Security 2

Question 1

A telehealth provider wants to use a patient's de-identified data for a quality improvement study. Under HIPAA, which standard must be met for data to qualify as truly de-identified?

Accepted Answer

Apply the Safe Harbor method by removing all 18 specified identifiers

Answer

Remove only the patient's name and date of birth

Answer

Obtain verbal consent from the patient before use

Answer

Store the data on an encrypted server with access controls

Question 2

Which encryption standard is currently recommended by NIST for protecting electronic protected health information (ePHI) in transit?

Accepted Answer

TLS 1.2 or higher

Answer

SSL 3.0

Answer

DES (Data Encryption Standard)

Answer

RC4

Question 3

A telehealth clinic experiences a ransomware attack that encrypts patient records. What is the FIRST action the security officer should take?

Accepted Answer

Isolate affected systems from the network immediately

Answer

Pay the ransom to restore access quickly

Answer

Notify all patients about the breach via email

Answer

Restore data from backup without investigating the incident

Question 4

Under HIPAA, how long must a covered entity retain documentation of its security policies and procedures?

Accepted Answer

6 years from creation or last effective date

Answer

3 years from creation or last effective date

Answer

10 years from creation or last effective date

Answer

Indefinitely

Question 5

A telehealth platform uses role-based access control (RBAC). Which principle does this BEST support?

Accepted Answer

Minimum necessary access

Answer

Data integrity

Answer

Non-repudiation

Answer

Data portability

Question 6

A patient emails their telehealth provider through a standard unsecured email service requesting medical advice. What is the provider's BEST response?

Accepted Answer

Reply only via a HIPAA-compliant secure messaging platform

Answer

Reply with clinical advice since the patient initiated the communication

Answer

Ignore the email as unsecured channels cannot be used for any communication

Answer

Ask the patient to re-send the email using a different email provider

Question 7

What is the purpose of a Business Associate Agreement (BAA) in a telehealth setting?

Accepted Answer

It establishes that a vendor handling ePHI is contractually bound to HIPAA safeguards

Answer

It sets billing rates between the provider and the patient

Answer

It replaces the need for a Notice of Privacy Practices

Answer

It authorizes the business associate to sell patient data for research