EDI Security and Compliance 2 — Questions and Answers
Question 1: Which encryption standard is most commonly recommended for securing EDI data in transit over the internet?
- DES
- TLS 1.2 or higher (Correct answer)
- MD5
- Base64 encoding
Correct answer: TLS 1.2 or higher
TLS 1.2 or higher is the current standard for encrypting EDI transmissions over the internet, replacing older protocols like SSL.
Question 2: What does non-repudiation mean in the context of EDI security?
- Preventing duplicate transactions
- Ensuring a sender cannot deny sending a message (Correct answer)
- Encrypting data at rest
- Blocking unauthorized access to EDI networks
Correct answer: Ensuring a sender cannot deny sending a message
Non-repudiation ensures that a trading partner cannot later deny having sent or received an EDI transaction, typically enforced through digital signatures.
Question 3: In EDI compliance, what is the primary purpose of a Trading Partner Agreement (TPA)?
- To define technical standards for data format only
- To establish legal and operational rules between trading partners (Correct answer)
- To encrypt EDI messages
- To log all transaction timestamps
Correct answer: To establish legal and operational rules between trading partners
A Trading Partner Agreement defines the legal, operational, and technical obligations between parties engaging in EDI transactions.
Question 4: Which HIPAA rule specifically governs the security of electronic Protected Health Information (ePHI) in EDI?
- Privacy Rule
- Breach Notification Rule
- Security Rule (Correct answer)
- Enforcement Rule
Correct answer: Security Rule
The HIPAA Security Rule establishes national standards for protecting ePHI that is created, received, used, or maintained electronically.
Question 5: What is the role of a Message Authentication Code (MAC) in EDI transactions?
- To compress EDI file sizes
- To verify the integrity and authenticity of a message (Correct answer)
- To route messages to the correct VAN
- To translate between EDI formats
Correct answer: To verify the integrity and authenticity of a message
A MAC is a short piece of information used to authenticate a message and confirm it was not altered in transit.
Question 6: Under PCI DSS, which requirement most directly affects companies transmitting payment data via EDI?
- Requirement 1: Install firewalls
- Requirement 3: Protect stored cardholder data
- Requirement 4: Encrypt transmission of cardholder data across open networks (Correct answer)
- Requirement 9: Restrict physical access
Correct answer: Requirement 4: Encrypt transmission of cardholder data across open networks
PCI DSS Requirement 4 mandates encryption of cardholder data during transmission across open or public networks, which directly applies to EDI payment transactions.
Question 7: What is a key security risk introduced when using a Value-Added Network (VAN) for EDI?
- Increased translation errors
- Third-party access to sensitive transaction data (Correct answer)
- Slower transaction speeds
- Incompatibility with X12 standards
Correct answer: Third-party access to sensitive transaction data
Using a VAN means a third party handles your EDI data, introducing risks around that provider's security practices and potential data exposure.
EDI Security and Compliance 2
Which encryption standard is most commonly recommended for securing EDI data in transit over the internet?