CTP Digital Privacy and Security 3

Question 1

A telehealth provider uses a personal smartphone for patient video visits without any mobile device management (MDM) software. Which risk does this PRIMARILY create?

Accepted Answer

Inability to enforce remote wipe if the device is lost or stolen

Answer

Without MDM, there is no mechanism to remotely wipe ePHI from a lost or stolen personal device, creating a significant breach risk.

Question 2

Which of the following BEST describes a 'man-in-the-middle' (MITM) attack in a telehealth context?

Accepted Answer

An attacker intercepts and potentially alters communications between a patient and provider

Answer

In a MITM attack, an attacker secretly intercepts and can alter communications between two parties who believe they are communicating directly.

Question 3

A telehealth organization is evaluating a new EHR vendor. Which security document should the organization request FIRST to assess the vendor's security posture?

Accepted Answer

A SOC 2 Type II audit report

Answer

A SOC 2 Type II report provides an independent auditor's assessment of a vendor's security controls over a defined period of time.

Question 4

Under the HIPAA Breach Notification Rule, what is the maximum time a covered entity has to notify the Secretary of HHS of a breach affecting 500 or more individuals?

Accepted Answer

60 calendar days from discovery

Answer

For breaches affecting 500 or more individuals, HHS must be notified within 60 calendar days of discovery of the breach.

Question 5

A telehealth session is recorded with patient consent. Where should this recording be stored to remain HIPAA compliant?

Accepted Answer

In a HIPAA-compliant cloud storage solution with a signed BAA

Answer

Recordings containing ePHI must be stored in a HIPAA-compliant cloud environment where the vendor has signed a BAA.

(CTP) Certified Telehealth Practitioner Practice Test

(CTP) Certified Telehealth Practitioner Practice Test

CTP Digital Privacy and Security 3