HCISPP Regulatory and Standards Environment Questions and Answers — Questions and Answers
Question 1: A healthcare organization is conducting a risk analysis as part of its security management process. According to the HIPAA Security Rule, which of the following safeguard categories would this activity primarily fall under?
- Physical Safeguards
- Technical Safeguards
- Administrative Safeguards (Correct answer)
- Organizational Safeguards
Correct answer: Administrative Safeguards
The HIPAA Security Rule categorizes safeguards into three types: Administrative, Physical, and Technical. The Security Management Process, which includes conducting a risk analysis, is a core requirement of the Administrative Safeguards. These safeguards are the policies, procedures, and actions to manage the selection, development, implementation, and maintenance of security measures to protect ePHI.
Question 2: A U.S.-based employer with 50 employees is concerned about potential discrimination lawsuits. Which federal law prohibits this employer from using an individual's family medical history to make decisions about hiring, firing, or promotion?
- Health Insurance Portability and Accountability Act (HIPAA)
- Health Information Technology for Economic and Clinical Health (HITECH) Act
- Americans with Disabilities Act (ADA)
- Genetic Information Nondiscrimination Act (GINA) (Correct answer)
Correct answer: Genetic Information Nondiscrimination Act (GINA)
The Genetic Information Nondiscrimination Act (GINA) of 2008 is a federal law that protects individuals from genetic discrimination in health insurance and employment. Title II of GINA specifically prohibits employers from using genetic information, which includes family medical history, in making employment decisions. GINA's employment protections apply to employers with 15 or more employees.
Question 3: The HITECH Act was enacted to promote the adoption and meaningful use of health information technology. What was the primary mechanism used by the HITECH Act to encourage providers to adopt certified Electronic Health Record (EHR) technology?
- Mandatory government reporting of quality measures
- Financial incentives for early adoption and penalties for non-adoption (Correct answer)
- Grants for developing open-source EHR platforms
- Stricter breach notification rules for paper-based records
Correct answer: Financial incentives for early adoption and penalties for non-adoption
The HITECH Act established financial incentive programs under Medicare and Medicaid to encourage eligible professionals and hospitals to adopt and demonstrate "meaningful use" of certified EHRs. Providers who adopted the technology early received payments, while those who did not adopt EHRs by a certain deadline were subject to reduced Medicare payments.
Question 4: A hospital is implementing the NIST Risk Management Framework (RMF) to strengthen its cybersecurity posture. In which step of the RMF would the hospital classify its information systems based on the potential impact of a loss of confidentiality, integrity, and availability?
- Prepare
- Categorize (Correct answer)
- Select
- Monitor
Correct answer: Categorize
The second step of the NIST Risk Management Framework (RMF) is 'Categorize'. In this step, the organization categorizes the information and systems based on an impact analysis, considering the potential adverse effects on organizational operations, assets, and individuals if information security is compromised.
Question 5: Which international standard provides specific guidance and best practices for information security management within a healthcare context, acting as a sector-specific extension to the ISO/IEC 27002 standard?
- ISO/IEC 27001
- ISO/IEC 27701
- ISO 27799 (Correct answer)
- ISO 9001
Correct answer: ISO 27799
ISO 27799 provides guidelines for organizational information security standards and information security management practices in health informatics. It serves as a healthcare-specific implementation guide for the controls listed in ISO/IEC 27002 and is intended to be used in conjunction with ISO/IEC 27001.
Question 6: A medical device manufacturer wants to have its new networked infusion pump certified to an international standard that provides a framework for evaluating IT product security. The evaluation involves defining a Protection Profile (PP) and an Evaluation Assurance Level (EAL). Which standard is being described?
- NIST Cybersecurity Framework
- Common Criteria (ISO/IEC 15408) (Correct answer)
- HITRUST Common Security Framework (CSF)
- ISO 13485
Correct answer: Common Criteria (ISO/IEC 15408)
The Common Criteria for Information Technology Security Evaluation (recognized as ISO/IEC 15408) is an international standard for computer security certification. Its framework involves users specifying security requirements in a Protection Profile (PP), vendors making claims about their product's security in a Security Target (ST), and labs evaluating the product against an Evaluation Assurance Level (EAL).
HCISPP Regulatory and Standards Environment Questions and Answers
A healthcare organization is conducting a risk analysis as part of its security management process.
According to the HIPAA Security Rule, which of the following safeguard categories would this activity primarily fall under?