HCISPP Healthcare Privacy and Security Questions and Answers

Question 1

A hospital's billing department is preparing to send invoices to patients.
To complete this task, a billing specialist needs to access patient records.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following datasets is most appropriate for the specialist to access?

Accepted Answer

Only the patient's demographic information and a summary of services rendered with corresponding billing codes.

Answer

The patient's full medical history, including diagnoses, treatments, and physician notes.

Answer

Complete access to the Electronic Health Record (EHR) for all patients in the facility.

Answer

The patient's name, insurance provider, and the contact information for their primary care physician.

Question 2

A large metropolitan hospital discovers that an unencrypted, password-protected laptop containing the ePHI of 600 patients was stolen from a physician's car. The password is not considered a compensating control equivalent to encryption. According to the HITECH Act Breach Notification Rule, which of the following actions is the hospital required to take?

Accepted Answer

Notify the affected individuals, the Secretary of HHS, and prominent media outlets serving the area without unreasonable delay and within 60 calendar days of discovery.

Answer

Notify the affected individuals within 90 days and report the breach to HHS in its annual report.

Answer

Notify the Secretary of HHS immediately, but wait to notify patients until the police investigation is complete.

Answer

Only notify the affected individuals via first-class mail within 60 days, as the breach involved fewer than 1,000 patients.

Question 3

A healthcare organization is developing its HIPAA-compliant contingency plan. According to the Security Rule, which of the following is an essential, required component of this plan?

Accepted Answer

A data backup plan to create and maintain retrievable, exact copies of ePHI.

Answer

A detailed budget for replacing all IT hardware within 24 hours of a disaster.

Answer

A contract with a public relations firm to manage media inquiries.

Answer

An agreement with a competing hospital for mutual patient data hosting.

Question 4

Which of the following activities is best classified as a HIPAA Security Rule 'Administrative Safeguard'?

Accepted Answer

Conducting security awareness and training programs for all workforce members.

Answer

Installing firewall software to protect the internal network from outside intrusion.

Answer

Implementing role-based access controls to limit user access to ePHI.

Answer

Placing workstation monitors in positions that prevent public viewing of ePHI.

Question 5

A health-tech company based in the United States develops a wellness app that is marketed to and used by individuals in several European Union countries. The app collects personal health data. Under which circumstance is the company MOST LIKELY required to appoint a Data Protection Officer (DPO)?

Accepted Answer

If the company's core activities involve large-scale, regular and systematic monitoring of individuals.

Answer

If the company has more than 250 employees worldwide.

Answer

Because the company processes any type of personal data, regardless of volume.

Answer

Only if the company has a physical office or subsidiary located within the European Union.

Question 6

Within the context of a healthcare organization's information security program, what is the primary distinction between risk analysis and risk management?

Accepted Answer

Risk analysis is the process of identifying and evaluating potential threats and vulnerabilities, while risk management is the broader process of implementing measures to mitigate those identified risks.

Answer

Risk analysis is performed by a third-party auditor, while risk management is an internal function.

Answer

Risk analysis focuses on financial impact, whereas risk management focuses on technical controls.

Answer

Risk analysis is an optional best practice, while risk management is a mandatory HIPAA requirement.