CTP Digital Privacy and Security 2

Question 1

A telehealth provider wants to use a patient's de-identified data for a quality improvement study. Under HIPAA, which standard must be met for data to qualify as truly de-identified?

Accepted Answer

Apply the Safe Harbor method by removing all 18 specified identifiers

Answer

HIPAA's Safe Harbor method requires removal of all 18 specified identifiers to consider health data de-identified.

Question 2

Which encryption standard is currently recommended by NIST for protecting electronic protected health information (ePHI) in transit?

Accepted Answer

TLS 1.2 or higher

Answer

NIST recommends TLS 1.2 or higher for encrypting ePHI in transit, as older protocols have known vulnerabilities.

Question 3

A telehealth clinic experiences a ransomware attack that encrypts patient records. What is the FIRST action the security officer should take?

Accepted Answer

Isolate affected systems from the network immediately

Answer

Isolating affected systems prevents ransomware from spreading to additional systems and is the immediate containment priority.

Question 4

Under HIPAA, how long must a covered entity retain documentation of its security policies and procedures?

Accepted Answer

6 years from creation or last effective date

Answer

HIPAA requires covered entities to retain security documentation for 6 years from the date of creation or the date it was last in effect.

Question 5

A telehealth platform uses role-based access control (RBAC). Which principle does this BEST support?

Accepted Answer

Minimum necessary access

Answer

RBAC enforces the minimum necessary principle by granting users only the access required for their specific role.

(CTP) Certified Telehealth Practitioner Practice Test

(CTP) Certified Telehealth Practitioner Practice Test

CTP Digital Privacy and Security 2