HCISPP Information Governance and Risk Questions and Answers

Question 1

A rural clinic's risk analysis identifies a high-impact, low-likelihood risk of a natural disaster disabling their on-premise data center.
Lacking the budget for a geographically separate hot site, the clinic's leadership decides to purchase a comprehensive cybersecurity and business interruption insurance policy.
This action is an example of which risk treatment strategy?

Accepted Answer

Risk Transference

Answer

Risk Mitigation

Answer

Risk Avoidance

Answer

Risk Acceptance

Question 2

Within a mature healthcare information governance program, which role is typically responsible for the day-to-day management and operational control of a specific data asset, including implementing and maintaining technical security controls as defined by policies and standards?

Accepted Answer

Data Custodian

Answer

Data Owner

Answer

Data Steward

Answer

Data Protection Officer (DPO)

Question 3

A hospital's legal department issues a 'legal hold' on all electronic and paper records related to a specific patient due to pending litigation. Which of the following information governance processes is MOST directly and immediately impacted by this action?

Accepted Answer

Record Retention and Disposition

Answer

Data Classification

Answer

Data Backup and Recovery

Answer

Information Risk Analysis

Question 4

A healthcare system's main Information Security Policy states, 'All ePHI must be encrypted in transit and at rest.' To implement this, the IT department creates a document specifying that TLS 1.3 or higher must be used for all data in transit and AES-256 for all data at rest. According to the policy, standard, procedure, and guideline hierarchy, how would the IT department's document be BEST classified?

Accepted Answer

A standard

Answer

A policy

Answer

A guideline

Answer

A procedure

Question 5

ARMA International's Generally Accepted Recordkeeping Principles® (GARP) provides a framework for effective information governance. Which principle specifically addresses the need to ensure that an organization's records are authentic and reliable?

Accepted Answer

Principle of Integrity

Answer

Principle of Accountability

Answer

Principle of Protection

Answer

Principle of Availability

Question 6

A healthcare research institution is creating a data classification scheme for its information assets, which include patient-consented research data, anonymized statistical data, employee PII, and public research papers. Which of the following is the MOST critical driver for classifying this data?

Accepted Answer

Data sensitivity and regulatory requirements

Answer

Data storage cost

Answer

Data accessibility speed

Answer

Data creation date