Deck 4: Security Ruling Explained

Question 1

Risk management for the HIPAA Security Officer is a "one-time" task.

Answer 1

False

Question 2

One good requirement to ensure secure access control is to install automatic logoff at each workstation.

Answer 2

True

Question 3

If a business visitor is also a Business Associate, that individual does not need to be escorted in the building to ensure protection of PHI.

Answer 3

False

Question 4

The Security Rule requires that all paper files of medical records be copied and kept securely locked up.

Question 5

Only a serious security incident is to be documented and measures taken to limit further disclosure.

Question 6

Requirements that are identified as "addressable" under the Security Rule may be omitted by the Security Officer.

Question 7

"At home" workers such as transcriptionists are not required to follow the workstation security rules for passwords, viewing of monitors by others, or locking of computer screens.

Question 8

Identify the choice that best completes the statement or answers the question.
Keeping e-PHI secure includes which of the following?

A)The HIPAA Security Officer places limits on what information is viewed by Business Associates determined by their job description.
B)Policies and procedures are written to protect against unlawful access by administration.
C)Changing the passwords for computer access every 30 days.
D)Safeguards are in place to protect e-PHI against unauthorized access or loss.

Question 9

Closed circuit cameras are mandated by HIPAA Security Rule.

Question 10

Identify the choice that best completes the statement or answers the question.
Which are the five areas the DHHS has mandated each covered entity to address so that e-PHI is maintained securely?

A)Organization requirements; policies, procedures, and documentation; technical safeguards; administrative safeguards; and physical safeguards
B)Unique identifiers; administrative safeguards; technical safeguards; physical safeguards; and electronic signatures
C)Administrative safeguards; physical safeguards; policies, procedures, and documentation; a HIPAA Security Officer in charge; and a complex computer data backup system
D)Policies, procedures, and documentation; organization requirements; protected wireless access; secure firewalls; and virus protection

Question 11

Security and privacy of protected health information really cover the same issues.

Question 12

Compliance to the Security Rule is solely the responsibility of the Security Officer.

Question 13

To protect e-PHI that is sent through the Internet, a covered entity must use encryption technology to minimize the risks.E-PHI that is "at rest" must also be encrypted to maintain security.

Question 14

The Office of HIPAA Standards seeks voluntary compliance to the Security Rule.

Question 15

Security of e-PHI has to do with keeping the data secure from a breach in the information system's security protocols.

Question 16

Identify the choice that best completes the statement or answers the question.
HIPAA Security Rule applies to data contained in

A)unrecorded video teleconferencing.
B)any computer storage media.
C)voicemail messages.
D)paper-to-paper faxes.

Question 17

Identify the choice that best completes the statement or answers the question.
Access privilege to protected health information is

A)having the ability to enter a facility where paper medical records are kept.
B)what allows an individual to enter a computer system for an authorized purpose.
C)finding a password to gain access to medical information.
D)permitted only to the HIPAA Officer and the computer technicians.

Question 18

The Office of HIPAA Standards may not initiate an investigation without receiving a formal complaint.

Question 19

Only monetary fines may be levied for violation under the HIPAA Security Rule.

Question 20

The Centers for Medicare and Medicaid Services (CMS) have information on their Web site to help a HIPAA Security Officer know the required and addressable areas of securing e-PHI.

Question 21

Identify the choice that best completes the statement or answers the question.
The ability to continue after a disaster of some kind is a requirement of Security Rule.What item is considered part of the contingency plan or business continuity plan?

A)Regular biohazard drills
B)Risk analysis
C)Emergency mode operation plan
D)Find someone to figure the payroll

Question 22

Identify the choice that best completes the statement or answers the question.
Complaints about security breaches may be reported to

A)Centers for Medicare and Medicaid Services.
B)Office of E-Health Standards and Services.
C)Office for Civil Rights.
D)Office of HIPAA Standards.

Question 23

Identify the choice that best completes the statement or answers the question.
The Security Officer is to keep record of

A)all computer hardware and software used within the facility when it comes in and when it goes out of the facility.
B)just the addition of hardware and software within the facility to be sure they are compliant with the Security Rule.
C)just the removal of hardware and software within the facility to be sure all data is removed.
D)the net value of disposed equipment that the facility has removed from use.

Question 24

Identify the choice that best completes the statement or answers the question.
Business Associate contracts must include

A)wording that protects the integrity of HIPAA standard transmissions.
B)assurance that each covered entity will use the HIPAA identifiers in transmissions.
C)implementation of safeguards to ensure data integrity.
D)only items as related to the Privacy Rule.

Question 25

Identify the choice that best completes the statement or answers the question.
The Security Officer is responsible to review all

A)Business Associate contracts for compliancy issues.
B)Trading Partner agreements to ensure they are fully complying with HIPAA rules.
C)Both A and B as required by Organization Requirements of Security Rule.
D)Neither A nor B in order to comply with the Security Rule.

Question 26

Identify the choice that best completes the statement or answers the question.
Reasonable physical safeguards for patient care areas include

A)a staff escort at all times.
B)having monitors turned away from viewing by visitors.
C)having a sign-in and sign-out register for all visitors.
D)providing all visitors with your policy document.

Question 27

Identify the choice that best completes the statement or answers the question.
Integrity of e-PHI requires confirmation that the data

A)has been backed up routinely.
B)is accurate and has not been altered, lost, or destroyed in an unauthorized manner.
C)has accepted all changes and modifications to the medical record.
D)has been reviewed by the Security Officer as being accurate.

Question 28

Identify the choice that best completes the statement or answers the question.
Use of e-mail for transmitting PHI is

A)permitted only if a security algorithm is in place.
B)permitted without restrictions.
C)excluded from possible use under the Security Rule.
D)allowed only if both sender and receiver(s) agree to keep e-PHI private.

Question 29

Identify the choice that best completes the statement or answers the question.
The required areas of the Security Rule

A)must be met with documentation being optional since everyone must comply.
B)must be achieved and documented.
C)may be met with a "reasonable and appropriate" approach.
D)are the administrative and technical safeguards.

Question 30

Identify the choice that best completes the statement or answers the question.
Risk analysis in the Security Rule considers

A)when the Security Officer includes budget items to pay for a better computer system.
B)how hard it is for hackers to access the computer system.
C)a balance between what is cost-effective and the potential risks of disclosure.
D)the cost of insurance to cover possible losses.

Question 31

Identify the choice that best completes the statement or answers the question.
What step is part of reporting of security incidents?

A)Report disclosure to all patients.
B)Exclude notation of incident from the patient's medical record.
C)Notify Business Associates and Trading Partners of the breach.
D)Change passwords to protect from further invasion.

Question 32

Identify the choice that best completes the statement or answers the question.
Information access is a required administrative safeguard under HIPAA Security Rule.It is defined as

A)access to the medical record for treatment purposes.
B)limiting access to the minimum necessary for the particular job assigned to the particular login.
C)restricting access to only clinical staff for treatment purposes, medical records department for coding purposes, and the billing department for purposes of claim submission.
D)only allowing patients access to their medical records if it is court ordered.

Question 33

Identify the choice that best completes the statement or answers the question.
Audit trails of computer systems include

A)who logged in, what was done, when it was done, and what equipment was accessed.
B)who logged in, what was changed, and when it was altered.
C)all user's passwords and login information.
D)all security incidents recorded in patient records.

Question 34

Identify the choice that best completes the statement or answers the question.
The Administrative Safeguards mandated by HIPAA include which of the following?

A)Unique health plan identifiers
B)Workforce security training
C)Evaluation of computer security effectiveness
D)Sanctions for unauthorized disclosures

Question 35

Identify the choice that best completes the statement or answers the question.
Record of HIPAA training is to be maintained by a health care provider for

A)4 years.
B)6 years.
C)7 years.
D)an indefinite time.

Question 36

Identify the choice that best completes the statement or answers the question.
Telemedicine videoconference tapes are

A)never covered by HIPAA Security Rule.
B)covered by HIPAA Security Rule if they are not erased after the physician's report is signed.
C)covered by HIPAA Security Rule only if the patient has not signed a consent form.
D)not covered by HIPAA Security Rule if used to train medical students.

Question 37

Identify the choice that best completes the statement or answers the question.
Which of the following items is a technical safeguard of the Security Rule?

A)Workstation location
B)Data backup plan
C)Sufficient storage capacity
D)Entity authentication

Question 38

Identify the choice that best completes the statement or answers the question.
The act of changing readable text into a vast series of "garbled" characters using complex mathematical algorithms is called

A)decoded messages.
B)transmission architecture.
C)HIPAA protocol.
D)encryption.

Question 39

Identify the choice that best completes the statement or answers the question.
Investigation of complaints of violations to the Security Rule are under the direction of the

A)Department of Justice.
B)Department of Health and Human Services.
C)Office of HIPAA Standards.
D)Office of Inspector General.

Question 40

Identify the choice that best completes the statement or answers the question.
Responsibilities of the HIPAA Security Officer include

A)making recommendations for new computers and seeing that they are configured to ensure secure e-PHI.
B)developing and implementing policies and procedures for the facility.
C)overseeing the training of new doctors and the retraining of all doctors on a regular basis.
D)reviewing the Notice of Privacy Practices for the facility and keeping them up to date.

Question 41

Identify the choice that best completes the statement or answers the question.
Whenever a device has become obsolete, the Security Office must

A)check the item off the list of equipment to maintain in the facility.
B)verify that the facility does not need the equipment any more before selling it.
C)log the date of disposal and the amount of its depreciation.
D)record when and how it is disposed of and that all data was deleted from the device.

Question 42

Match the HIPAA term with the correct definition.

Implementing policies and procedures to prevent, detect, and contain any intrusions of security or unauthorized access.

A)Risk management
B)Gap analysis
C)Risk analysis
D)Security management

Question 43

Match the item that is addressed under the Security Rule with the correct area of safeguards.

contingency plan or business continuity plan

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 44

Match the HIPAA term with the correct definition.

A process whereby cost-effective security control measures may be selected to balance the cost of security control measures against the losses expected if these measures were not in place.

A)Risk management
B)Gap analysis
C)Risk analysis
D)Security management

Question 45

Match the item that is addressed under the Security Rule with the correct area of safeguards.

facility access controls

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 46

Identify the choice that best completes the statement or answers the question.
HIPAA training must be provided to

A)all clinical staff personnel.
B)only volunteer and nonpaid staff.
C)only new employees.
D)all workforce employees and nonemployees.

Question 47

Match the item that is addressed under the Security Rule with the correct area of safeguards.

integrity of data

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 48

Match the item that is addressed under the Security Rule with the correct area of safeguards.

Business Associate contract

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 49

Identify the choice that best completes the statement or answers the question.
The policy of disclosing the "minimum necessary" e-PHI addresses

A)those who bill health claims only.
B)authorizing personnel to view PHI.
C)information sent to a health plan for reimbursement.
D)all clinical staff when treating a patient.

Question 50

Match the item that is addressed under the Security Rule with the correct area of safeguards.

device and media controls

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 51

Match the item that is addressed under the Security Rule with the correct area of safeguards.

access control by login and password

A)Administrative safeguards
B)Physical safeguards
C)Technical safeguards

Question 52

Match the HIPAA term with the correct definition.

A study to find the problems or gaps between current practices and what the Security Rule requires.

A)Risk management
B)Gap analysis
C)Risk analysis
D)Security management

Question 53

Match the HIPAA term with the correct definition.

An ongoing process that considers the risk to electronic information and the data itself to determine if there is adequate security for the system to keep exposure to loss or alteration of PHI to a minimum.

A)Risk management
B)Gap analysis
C)Risk analysis
D)Security management