Certification Exam: HIPAA Security Rule

Question 1 of 10

Under the Breach Notification Rule, how is an impermissible disclosure initially treated?

A) As a breach only if more than 500 people are affected B) As presumed to be a breach unless the entity shows a low probability that PHI was compromised C) As a breach only if the data was unencrypted and exfiltrated D) As not a breach unless a patient complains

Question 2 of 10

Within what time must individuals be notified of a breach of unsecured PHI?

A) Without unreasonable delay and no later than 60 days from discovery B) Only at the end of the calendar year C) Within 24 hours D) Within 6 months

Question 3 of 10

What does 'addressable' mean for a Security Rule implementation specification?

A) It becomes required only after a breach B) It is optional and may be skipped C) It must be assessed, and either implemented or documented as not reasonable with an equivalent alternative adopted D) It applies only to organisations with over 500 employees

Question 4 of 10

What does the HIPAA Security Rule protect, as distinct from the Privacy Rule?

A) Only billing and payment records B) Electronic PHI specifically C) PHI in any form, including paper and spoken D) Only records held by business associates

Question 5 of 10

Six staff share one 'frontdesk' login to the EHR. Which requirement does this violate?

A) Unique user identification B) Automatic logoff C) Facility access controls D) Transmission security

Question 6 of 10

Which Security Rule requirement is most frequently cited in OCR enforcement actions?

A) Failure to shred paper records B) Failure to appoint a privacy officer C) Failure to install antivirus software D) Failure to conduct an accurate and thorough risk analysis

Question 7 of 10

A breach affects 750 individuals. What must be reported to HHS, and when?

A) Include it in the annual log submitted after year end B) Report only if the media asks C) Report within 60 days of discovery D) Nothing; only individuals are notified

Question 8 of 10

An encrypted laptop containing ePHI is stolen. The encryption key was not compromised. What generally follows?

A) A reportable breach requiring notification within 60 days B) Automatic penalties in the willful neglect tier C) Generally no reportable breach, because the PHI is not unsecured D) Immediate media notification regardless of numbers

Question 9 of 10

A cloud provider stores your organisation's ePHI but never accesses it, and the data is encrypted. What is it?

A) Exempt because the data is encrypted B) A conduit, so no agreement is needed C) Covered only if it is located in the United States D) A business associate requiring a business associate agreement

Question 10 of 10

Which of the following is a required, not addressable, specification?

A) Disposal of media containing ePHI B) Encryption of data at rest C) Automatic logoff D) Testing of the contingency plan