1-The HIPAA Security Rule protects: verbal data electronic data written data All of the

1-The HIPAA Security Rule protects:

verbal data

electronic data

written data

All of the above

2-According to HIPAA, PHI does NOT include:

IP addresses

Patient's past medical treatment information

Payments for  health care provision

Health information with the identifiers removed

3-Which of the following access control mechanisms used to prevent employees from copying a document labeled with high security to another document labeled with 'public'?

Firewall

Zones

Encryption

Archive

4-It would be appropriate to release patient information to:

the patient's (non-attending) physician brother

personnel from the hospital the patient transferred from 2 days ago, who is calling to check on the patient

the respiratory therapy personnel doing an ordered procedure

retired physician who is a friend of the family

5-Healthcare providers must ensure the confidentiality, integrity, and availability of electronic protected health information (ePHI) that the covered entity creates, receives, maintains, or transmits under:

HIPAA

EHR

FCRA

FERPA

6-The mission of the law is to protect consumers’ personal financial information held by financial institutions

PCAOB

PHR

HIPAA

GLB

7-Which of the following statements about retention principles is true?

Organizations should keep business records as long as possible.

We only need to manage the records that are in use.

How long the records should be kept depends on  the legal requirements and business needs.

Due to the security consideration, organizations should retain records longer than required.

8-Red flag rule requires that financial institutions:

must implement a written Identity Theft prevention Program

must comply with PCI standards

notify the customer that they may be a victim of identity theft

All of the above

9-Restricting access to the IT Department office of a hospital would fall under which type of safeguard required by the Security Rule of HIPAA?

electronic

technical

physical

administrative

10-According to Omnibus Final Rule, which of the following statements are correct?

If one EMR software vendor needs access to PHI, it would need to complete a BAA.

Business associates does not include entity that  maintain PHI.

A BAA is required for the US Postal Service.

Cloud service providers for EMR storage and backup are not liable for compliance with the HIPAA privacy rule.

11-Which of the following is not part of the PII definition established by GAPP:

Address

Credit card number

Student ID

Medical information

12-This term refers to the security practice where no one has more access than is needed to do their job

Auditing

Least privilege

Authentication

CIA Triangle

13-The law “to protect investors by improving the accuracy and reliability of corporate disclosures made pursuant to securities laws, and for other purposes.”

CIA

PCI

SOX

SEC

14-Being able to recover records after a disaster:

Effectiveness

Efficiency

Competency

Continuity

15-Law that requires a free credit report annually

FACTA

Red Flag Rule

FERPA

FCRA

16-Any list, description, or other grouping of consumers (and publicly available information pertaining to them) derived using any personally identifiable financial information that is not publicly available

PII

NPI

FTC

PIN

17-Which of the following is specific to the health care industry?

PII

Non-public financial information

Student academic record

PHI

18-The statutory requirement that public companies submit quarterly and annual reports is promulgated by which agency:

FBI

SEC

CIA

CICA

19-Disposition is not part of the records management lifecycle.

True.

False.

20-In the CIA Triangle, the letters  refer to what:

Confidentiality, Integrity, and Availability

Central Intelligence Agency

Confidentiality, Intrusion, and Availability

Cybersecurity In Action