CIIP Healthcare Information Security and Privacy

Question 1

Under HIPAA, which of the following is considered Protected Health Information (PHI) in a radiology context?

Accepted Answer

Patient name combined with a radiological diagnosis

Answer

PHI includes any individually identifiable health information, such as a patient name linked to a diagnosis or imaging study.

Question 2

Which HIPAA rule specifically governs the technical safeguards for electronic PHI stored in PACS?

Accepted Answer

HIPAA Security Rule

Answer

The HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic PHI (ePHI), including systems like PACS.

Question 3

A radiology technologist accidentally emails a patient's MRI report to the wrong recipient. Under HIPAA, this is classified as a:

Accepted Answer

Breach of unsecured PHI

Answer

An accidental disclosure of unsecured PHI to an unauthorized recipient meets the definition of a HIPAA breach requiring notification.

Question 4

Which encryption standard is recommended by NIST for protecting ePHI at rest in imaging systems?

Accepted Answer

AES-256

Answer

AES-256 (Advanced Encryption Standard with 256-bit keys) is the NIST-recommended standard for encrypting ePHI at rest.

Question 5

In the context of imaging informatics, what is the primary purpose of role-based access control (RBAC)?

Accepted Answer

Ensure users can only access PHI necessary for their job function

Answer

RBAC restricts system access based on a user's organizational role, enforcing the minimum necessary standard for PHI access.

CIIP - Certified Imaging Informatics Professional Practice Test