Question 1

Which of the following statements best describes the HIPAA breach notification rules?

Accepted Answer

A)  Covered entities are required to notify individuals for any ePHI breach within 90 days after the discovery of the breach. 
B)  Covered entities are required to notify individuals for breach of unsecured ePHI within 60 days after the discovery of the breach. 
C)  Covered entities are required to notify individuals for any ePHI breach within 30 days after the discovery of the breach. 
D)  Covered entities are required to notify individuals for breach of unsecured ePHI within 30 days after the discovery of the breach. 
A)  Covered entities are required to notify individuals for any ePHI breach within 90 days after the discovery of the breach. 
B)  Covered entities are required to notify individuals for breach of unsecured ePHI within 60 days after the discovery of the breach. 
C)  Covered entities are required to notify individuals for any ePHI breach within 30 days after the discovery of the breach. 
D)  Covered entities are required to notify individuals for breach of unsecured ePHI within 30 days after the discovery of the breach. B

Question 2

Which of the following is not one of the three risk management activities in the security management process?

Accepted Answer

A)  Protections 
B)  Analysis 
C)  Measures 
D)  Plan 
A)  Protections 
B)  Analysis 
C)  Measures 
D)  Plan B

Question 3

Which of the following are the two required implementation specifications of the access control standard under HIPAA?

Accepted Answer

A)  Unique user identification and establishing emergency access procedures 
B)  Implementing automatic logoff procedures and encrypting/decrypting information at rest 
C)  Unique user identification and implementing automatic logoff procedures 
D)  Encrypting/decrypting information at rest and establishing emergency access procedures 
A)  Unique user identification and establishing emergency access procedures 
B)  Implementing automatic logoff procedures and encrypting/decrypting information at rest 
C)  Unique user identification and implementing automatic logoff procedures 
D)  Encrypting/decrypting information at rest and establishing emergency access procedures A

Question 4

Which of the following is an example of a HIPAA physical safeguard standard?

Accepted Answer

A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Security Incident Response 
A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Security Incident Response

Question 5

Which of the following is the goal of an Integrity Controls standard?

Accepted Answer

A)  Implementing technical controls that protect ePHI from improper alteration or destruction 
B)  Restricting access to ePHI only to users and processes that have been specifically authorized 
C)  Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI 
D)  Verification that a person or process seeking to access ePHI is the one claimed 
A)  Implementing technical controls that protect ePHI from improper alteration or destruction 
B)  Restricting access to ePHI only to users and processes that have been specifically authorized 
C)  Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI 
D)  Verification that a person or process seeking to access ePHI is the one claimed

Question 6

Which of the following statements best describes a health-care provider?

Accepted Answer

A)  A person or organization that provides patient or medical services 
B)  An entity that provides payment for medical services 
C)  An entity that processes nonstandard health information it receives from another entity 
D)  A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI 
A)  A person or organization that provides patient or medical services 
B)  An entity that provides payment for medical services 
C)  An entity that processes nonstandard health information it receives from another entity 
D)  A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI

Question 7

According to HIPAA, which of the following refers to anyone who does work at or for an organization?

Accepted Answer

A)  Staff 
B)  Personnel 
C)  Employee 
D)  Workforce 
A)  Staff 
B)  Personnel 
C)  Employee 
D)  Workforce

Question 8

Which of the following statements best describes a health-care clearinghouse?

Accepted Answer

A)  A person or organization that provides patient or medical services 
B)  An entity that provides payment for medical services 
C)  An entity that processes nonstandard health information it receives from another entity 
D)  A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI 
A)  A person or organization that provides patient or medical services 
B)  An entity that provides payment for medical services 
C)  An entity that processes nonstandard health information it receives from another entity 
D)  A person or entity that creates, receives, maintains, transmits, accesses, or has the potential to access ePHI

Question 9

Which of the following was given the authority to bring criminal action against covered entities that wrongly disclose ePHI?

Accepted Answer

A)  Department of Justice 
B)  Local law enforcement 
C)  Department of Health and Human Services 
D)  State Attorney 
A)  Department of Justice 
B)  Local law enforcement 
C)  Department of Health and Human Services 
D)  State Attorney

Question 10

Which of the following is a change made to HIPAA by the Omnibus Rule?

Accepted Answer

A)  Expanded the definition of "business associates" 
B)  Increased penalties for violations to up to $1.5 million 
C)  Granting authority to state Attorneys General to enforce HIPAA rules and pursue criminal and civil cases 
D)  All of the above 
A)  Expanded the definition of "business associates" 
B)  Increased penalties for violations to up to $1.5 million 
C)  Granting authority to state Attorneys General to enforce HIPAA rules and pursue criminal and civil cases 
D)  All of the above

Question 11

Which of the following is an example of a HIPAA technical safeguard standard?

Accepted Answer

A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Workstation Security 
A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Workstation Security

Question 12

Who should be notified of ePHI breaches?

Accepted Answer

A)  Department of Justice 
B)  Local law enforcement 
C)  Department of Health and Human Services 
D)  State Attorney 
A)  Department of Justice 
B)  Local law enforcement 
C)  Department of Health and Human Services 
D)  State Attorney

Question 13

Which of the following is an example of a HIPAA administrative safeguard standard?

Accepted Answer

A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Workstation Security 
A)  Workforce Security 
B)  Workstation Use 
C)  Audit Controls 
D)  Workstation Security

Question 14

Which of the following backup types backs up anything that has changed since the last backup of any type?

Accepted Answer

A)  Differential 
B)  Cumulative incremental 
C)  Incremental 
D)  Full 
A)  Differential 
B)  Cumulative incremental 
C)  Incremental 
D)  Full

Question 15

Which of the following is the goal of an Audit Controls standard?

Accepted Answer

A)  Implementing technical controls that protect ePHI from improper alteration or destruction 
B)  Restricting access to ePHI only to users and processes that have been specifically authorized 
C)  Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI 
D)  Verifying that a person or process seeking to access ePHI is the one claimed 
A)  Implementing technical controls that protect ePHI from improper alteration or destruction 
B)  Restricting access to ePHI only to users and processes that have been specifically authorized 
C)  Implementing hardware, software, and procedural mechanisms that record and examine activity in information systems that contain ePHI 
D)  Verifying that a person or process seeking to access ePHI is the one claimed

Question 16

Which of the following best describes HIPAA administrative safeguards?

Accepted Answer

A)  Retention, availability, and update requirements related to supporting documentation 
B)  The use of technical security measures to protect ePHI data 
C)  Standards for business associate contracts and other arrangements 
D)  Documented policies and procedures for managing day-to-day operations and access to ePHI 
A)  Retention, availability, and update requirements related to supporting documentation 
B)  The use of technical security measures to protect ePHI data 
C)  Standards for business associate contracts and other arrangements 
D)  Documented policies and procedures for managing day-to-day operations and access to ePHI

Question 17

Security awareness and training and workforce security standards are examples of which of the following?

Accepted Answer

A)  Administrative safeguards 
B)  Physical safeguards 
C)  Technical safeguards 
D)  Organizational requirements 
A)  Administrative safeguards 
B)  Physical safeguards 
C)  Technical safeguards 
D)  Organizational requirements

Question 18

Covered entities (CEs) include which of the following?

Accepted Answer

A)  Health-care providers 
B)  Health plans 
C)  Health-care clearinghouses 
D)  All of the above 
A)  Health-care providers 
B)  Health plans 
C)  Health-care clearinghouses 
D)  All of the above

Question 19

ePHI refers to which of the following?

Accepted Answer

A)  Electronic private health information 
B)  Electronic protected health information 
C)  Encrypted private health information 
D)  Encrypted protected health information 
A)  Electronic private health information 
B)  Electronic protected health information 
C)  Encrypted private health information 
D)  Encrypted protected health information

Question 20

Under the HITECH Act criminal violations can be brought against which of the following?

Accepted Answer

A)  Covered entities 
B)  Employees 
C)  Covered entities and employees 
D)  Anyone who wrongly discloses PHI 
A)  Covered entities 
B)  Employees 
C)  Covered entities and employees 
D)  Anyone who wrongly discloses PHI

Which of the following statements best describes the HIPAA breach notification rules?

Which of the following is not one of the three risk management activities in the security management process?

Which of the following are the two required implementation specifications of the access control standard under HIPAA?

Which of the following is an example of a HIPAA physical safeguard standard?

Which of the following is the goal of an Integrity Controls standard?

Which of the following statements best describes a health-care provider?

According to HIPAA, which of the following refers to anyone who does work at or for an organization?

Which of the following statements best describes a health-care clearinghouse?

Which of the following was given the authority to bring criminal action against covered entities that wrongly disclose ePHI?

Which of the following is a change made to HIPAA by the Omnibus Rule?

Which of the following is an example of a HIPAA technical safeguard standard?

Who should be notified of ePHI breaches?

Which of the following is an example of a HIPAA administrative safeguard standard?

Which of the following backup types backs up anything that has changed since the last backup of any type?

Which of the following is the goal of an Audit Controls standard?

Which of the following best describes HIPAA administrative safeguards?

Security awareness and training and workforce security standards are examples of which of the following?

Covered entities (CEs) include which of the following?

ePHI refers to which of the following?

Under the HITECH Act criminal violations can be brought against which of the following?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Cybersecurity Incident Response

Business Continuity Management

Regulatory Compliance for Financial Institutions

PCI Compliance for Merchants

Nist Cybersecurity Framework

Filters

Exam 14: Regulatory Compliance for the Health-Care Sector

Which of the following statements best describes the HIPAA breach notification rules?

Which of the following is not one of the three risk management activities in the security management process?

Which of the following are the two required implementation specifications of the access control standard under HIPAA?

Which of the following is an example of a HIPAA physical safeguard standard?

Which of the following is the goal of an Integrity Controls standard?

Which of the following statements best describes a health-care provider?

According to HIPAA, which of the following refers to anyone who does work at or for an organization?

Which of the following statements best describes a health-care clearinghouse?

Which of the following was given the authority to bring criminal action against covered entities that wrongly disclose ePHI?

Which of the following is a change made to HIPAA by the Omnibus Rule?

Which of the following is an example of a HIPAA technical safeguard standard?

Who should be notified of ePHI breaches?

Which of the following is an example of a HIPAA administrative safeguard standard?

Which of the following backup types backs up anything that has changed since the last backup of any type?

Which of the following is the goal of an Audit Controls standard?

Which of the following best describes HIPAA administrative safeguards?

Security awareness and training and workforce security standards are examples of which of the following?

Covered entities (CEs) include which of the following?

ePHI refers to which of the following?

Under the HITECH Act criminal violations can be brought against which of the following?

Understanding Cybersecurity Policy and Governance

Cybersecurity Policy Organization, Format, and Styles

Cybersecurity Framework

Governance and Risk Management

Asset Management and Data Loss Prevention

Human Resources Security

Physical and Environmental Security

Communications and Operations Security

Access Control Management

Information Systems Acquisition, Development, and Maintenance

Cybersecurity Incident Response

Business Continuity Management

Regulatory Compliance for Financial Institutions

PCI Compliance for Merchants

Nist Cybersecurity Framework

Filters