HCISPP Healthcare Privacy and Security Questions and Answers — Questions and Answers
Question 1: A hospital's billing department is preparing to send invoices to patients. To complete this task, a billing specialist needs to access patient records. According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following datasets is most appropriate for the specialist to access?
- The patient's full medical history, including diagnoses, treatments, and physician notes.
- Only the patient's demographic information and a summary of services rendered with corresponding billing codes. (Correct answer)
- Complete access to the Electronic Health Record (EHR) for all patients in the facility.
- The patient's name, insurance provider, and the contact information for their primary care physician.
Correct answer: Only the patient's demographic information and a summary of services rendered with corresponding billing codes.
The HIPAA 'minimum necessary' standard requires that covered entities take reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish the intended purpose. For billing, the specialist only needs information directly related to the services provided and the patient's identity for invoicing, not their entire clinical history.
Question 2: A large metropolitan hospital discovers that an unencrypted, password-protected laptop containing the ePHI of 600 patients was stolen from a physician's car. The password is not considered a compensating control equivalent to encryption. According to the HITECH Act Breach Notification Rule, which of the following actions is the hospital required to take?
- Notify the affected individuals within 90 days and report the breach to HHS in its annual report.
- Notify the Secretary of HHS immediately, but wait to notify patients until the police investigation is complete.
- Notify the affected individuals, the Secretary of HHS, and prominent media outlets serving the area without unreasonable delay and within 60 calendar days of discovery. (Correct answer)
- Only notify the affected individuals via first-class mail within 60 days, as the breach involved fewer than 1,000 patients.
Correct answer: Notify the affected individuals, the Secretary of HHS, and prominent media outlets serving the area without unreasonable delay and within 60 calendar days of discovery.
The HITECH Act Breach Notification Rule requires covered entities to notify affected individuals and the Secretary of HHS of a breach of unsecured PHI. For breaches affecting 500 or more individuals, notification must also be provided to prominent media outlets in the state or jurisdiction. All notifications must be made without unreasonable delay and no later than 60 calendar days following the discovery of the breach.
Question 3: A healthcare organization is developing its HIPAA-compliant contingency plan. According to the Security Rule, which of the following is an essential, required component of this plan?
- A detailed budget for replacing all IT hardware within 24 hours of a disaster.
- A contract with a public relations firm to manage media inquiries.
- An agreement with a competing hospital for mutual patient data hosting.
- A data backup plan to create and maintain retrievable, exact copies of ePHI. (Correct answer)
Correct answer: A data backup plan to create and maintain retrievable, exact copies of ePHI.
The HIPAA Security Rule's Contingency Plan standard explicitly requires several components, including a data backup plan, a disaster recovery plan, and an emergency mode operation plan. The data backup plan is fundamental, as it ensures that exact, retrievable copies of ePHI are maintained to be restored in the event of data loss.
Question 4: Which of the following activities is best classified as a HIPAA Security Rule 'Administrative Safeguard'?
- Installing firewall software to protect the internal network from outside intrusion.
- Implementing role-based access controls to limit user access to ePHI.
- Conducting security awareness and training programs for all workforce members. (Correct answer)
- Placing workstation monitors in positions that prevent public viewing of ePHI.
Correct answer: Conducting security awareness and training programs for all workforce members.
The HIPAA Security Rule categorizes safeguards into Administrative, Physical, and Technical. Administrative safeguards are the administrative actions, policies, and procedures used to manage the selection, development, implementation, and maintenance of security measures. Security awareness and training is a required implementation specification under the Administrative Safeguards.
Question 5: A health-tech company based in the United States develops a wellness app that is marketed to and used by individuals in several European Union countries. The app collects personal health data. Under which circumstance is the company MOST LIKELY required to appoint a Data Protection Officer (DPO)?
- If the company has more than 250 employees worldwide.
- Because the company processes any type of personal data, regardless of volume.
- If the company's core activities involve large-scale, regular and systematic monitoring of individuals. (Correct answer)
- Only if the company has a physical office or subsidiary located within the European Union.
Correct answer: If the company's core activities involve large-scale, regular and systematic monitoring of individuals.
Under the General Data Protection Regulation (GDPR), a DPO is mandatory if the core activities of the controller or processor consist of processing operations which require regular and systematic monitoring of data subjects on a large scale, or if they process large-scale sensitive data like health information. The location of the company does not negate this requirement if it processes the data of EU residents.
Question 6: Within the context of a healthcare organization's information security program, what is the primary distinction between risk analysis and risk management?
- Risk analysis is performed by a third-party auditor, while risk management is an internal function.
- Risk analysis focuses on financial impact, whereas risk management focuses on technical controls.
- Risk analysis is the process of identifying and evaluating potential threats and vulnerabilities, while risk management is the broader process of implementing measures to mitigate those identified risks. (Correct answer)
- Risk analysis is an optional best practice, while risk management is a mandatory HIPAA requirement.
Correct answer: Risk analysis is the process of identifying and evaluating potential threats and vulnerabilities, while risk management is the broader process of implementing measures to mitigate those identified risks.
Risk analysis is a required component of the HIPAA Security Rule where an organization must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Risk management is the subsequent and ongoing process of implementing security measures to reduce risks and vulnerabilities to a reasonable and appropriate level. In essence, analysis identifies the risks, and management addresses them.
HCISPP Healthcare Privacy and Security Questions and Answers
A hospital's billing department is preparing to send invoices to patients.
To complete this task, a billing specialist needs to access patient records.
According to the HIPAA Privacy Rule's 'minimum necessary' standard, which of the following datasets is most appropriate for the specialist to access?