Third-Party Risk Management Flashcards
6 cards from real HCISPP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 Third-Party Risk Management flashcards as text
A hospital's Business Associate Agreement (BAA) with a cloud storage provider includes a 'Termination for Cause' clause. Under what circumstance is the hospital MOST likely to invoke this clause?
Answer: The provider refuses to return or destroy the hospital's ePHI after the contract ends.
A 'Termination for Cause' clause is triggered by a material breach of the agreement. Refusing to return or destroy ePHI upon termination is a significant violation of the BAA and HIPAA itself, constituting a material breach. The other options describe normal business operations or minor issues not typically considered a material breach.
A healthcare clearinghouse (a business associate) hires a data analytics firm (a subcontractor) to process claims data containing PHI. According to HIPAA, what is the primary responsibility of the clearinghouse regarding this subcontractor?
Answer: To ensure the subcontractor signs a BAA that mirrors the same obligations the clearinghouse has.
The HIPAA Omnibus Rule requires that business associates ensure their subcontractors, who handle PHI, agree to the same restrictions and conditions that apply to the business associate. This 'flow-down' provision is accomplished by executing a BAA between the business associate and the subcontractor.
Which of the following activities is a critical component of the 'Ongoing Monitoring' phase of the third-party risk management lifecycle in a healthcare setting?
Answer: Conducting periodic risk re-assessments and performance reviews.
The third-party risk management lifecycle includes onboarding, ongoing monitoring, and offboarding. Ongoing monitoring specifically involves activities that occur throughout the relationship, such as periodic risk re-assessments, performance reviews, and continuous monitoring, to ensure the vendor remains compliant and secure. Initial due diligence and contract negotiation are part of onboarding, while data destruction is part of offboarding.
A medical transcription service (business associate) discovers that one of its employees emailed a batch of patient records to their personal, unsecured email account. The transcription service's BAA with the hospital requires it to report security incidents. What is the business associate's MOST immediate obligation?
Answer: Report the incident to the hospital without unreasonable delay.
Business Associate Agreements must contain provisions requiring the business associate to report any security incidents, including breaches of unsecured PHI, to the covered entity. HIPAA requires this notification to occur 'without unreasonable delay' and no later than 60 days following discovery. Waiting, terminating the employee, or notifying patients directly are not the primary, immediate contractual and regulatory obligation.
When a healthcare organization is evaluating a potential vendor's security posture during the due diligence phase, which of the following provides the highest level of assurance for ongoing compliance?
Answer: A SOC 2 Type 2 report.
A SOC 2 Type 2 report provides an independent auditor's opinion on the design and operational effectiveness of a vendor's security controls over a period of time (typically 6-12 months). This offers a much higher level of assurance than a vendor's own questionnaire, marketing materials, or a single point-in-time scan, which don't demonstrate sustained operational effectiveness.
A hospital is terminating its contract with a third-party vendor that stored ePHI. The BAA stipulates that the vendor must destroy all ePHI. What is the hospital's most crucial final step in the offboarding process?
Answer: Obtaining a certificate or written confirmation of data destruction.
The final stage of the vendor lifecycle, offboarding, must ensure that all PHI is handled appropriately. When the BAA requires data destruction, the covered entity must obtain proof that this has been completed securely and irretrievably. This documentation is critical for demonstrating HIPAA compliance and ensuring the data is no longer at risk.