Cybersecurity protects information systems against: a. Humans b. Threats that exploit a system's vulnerabilities c. Viruses d. Spam and phishing attempts

A firewall protects against the unauthorized transmission of ePHI between two computers within an internal network. a. True b. False

b. false

Data recovery should not include obtaining copies of records from entities that received records from the organization. a. True b. False

b. false

Large, medium, and small covered entities must all implement the HIPAA Security rule requirements in the same way. a. True b. False

b. false

Public key infrastructure is a less secure method of encryption because the key that decodes the information is transmitted with the data. a. True b. False

b. false

Ransomware is disseminated by viruses only. a. True b. False

b. false

The data backup plan is focused only on the electronic health record. a. True b. False

b. false

Cookies: a. Are based on trickery b. Identify a user's computer to a website c. Are a type of virus d. Are installed by information security experts to stop malicious incoming traffic

b. identify a users computer to a website

Ransomware resembles scareware, but it is different because: a. Its threat is fictitious b. Its threat is real c. There is no threat d. It employs social engineering

b. its threat is real

The MIPS composite performance score is based in part on: a. Ethical decision making b. HIPAA compliance c. Advancing care information d. Staffing levels

c. Advancing care information

A computer virus is unable to replicate itself a. True b. False

b. false

The HIPAA Security Rule is flexible. This means: a. A variety of different security measures may be used b. It applies to entities of any size c. It does not prescribe certain technologies d. Its standards are impossible to achieve

a. A variety of different security measures may be used

Changes to HIPAA are included in: a. HITECH b. Medicare Conditions of Participation c. Privacy Act of 1974 d. Child Abuse Prevention and Treatment Act

a. HITECH

Mary is a self-employed transcriptionist who transcribes physician office progress notes for several physician practices. Each document she transcribes is identified by the patient's name and medical record number. Mary: a. Is a business associate of the physician practices b. Is only a business associate of the physician practices that initiated business associate agreements c. Does not meet the definition of a business associate d. Is not legally liable for HIPAA violations she commits without a business associate agreement

a. Is a business associate of the physician practices

Deidentified information is: a. Not protected by HIPAA b. Always protected by HIPAA c. Protected by HIPAA only when it is used for research d. Protected by HIPAA only when it is used for vital statistics

a. Not protected by HIPAA

. A university with a medical center is a hybrid entity under HIPAA a. True b. False

a. True

Covered entities consist only of healthcare providers, health plans, and healthcare clearinghouses. a. True b. False

a. True

Use is the handling of PHI that is internal to a covered entity or BA. a. True b. False.

a. True

Weaknesses in Wi-Fi networks can be exploited by attackers to compromises a mobile phone user's personal information. a. True b. False

a. True

OCR has discretion to pursue corrective action without assessing penalties for which type of HIPAA violation? a. Unknowing or did not know b. Reasonable cause c. Willful neglect, corrected d. Willful neglect, uncorrected e. None of the above

a. Unknowing or did not know

General Hospital's health record department delivers a group of patient records to the quality improvement department for its monthly review. This constitutes: a. Use b. Disclosure c. A HIPAA violation d. None of the above

a. Use

Dr. Connor is able to access patient records remotely, even from less secure networks, by utilizing a secure tunnel to access the hospital's computer system. Based on these facts, Dr. Connor is utilizing: a. A virtual private network b. A firewall c. A public cloud d. Drive-by downloading

a. a virtual private network

Audit controls: a. Examine and record activity in systems with ePHI b. Assess data integrity c. Authenticate user identities d. Are a substitute for password management

a. examine and record activity in systems with ePHI

Which of the following characteristics describes a worm? a. It does not require human interaction to spread b. It is not a virus c. It is not a type of malware d. It appears to perform one action while actually performing a different action

a. it does not require human interaction to spread

Which approach to risk determination assigns values to the likelihood and effect of a particular threat? a. Qualitative b. Determinative c. Quantitative d. Reciprocal

a. qualitative

Which of the following is not a red flag category? a. Rejected credit card transactions b. Alerts and notifications c. Suspicious documents d. Suspicious personally identifying information

a. rejected credit card transactions

. A patient portal is often hosted and controlled by a provider or payer a. True b. False

a. true

. Per HIPAA, breach notification is one method by which an organization can mitigate a breach. a. True b. False

a. true

. Per the Red Flags Rule, creditors must develop and implement written identity theft programs in an effort to identify, detect, and respond to red flags. a. True b. False.

a. true

A single threat source may exploit more than one vulnerability. a. True b. False

a. true

Denial of service occurs when an attacker takes controls of a device to render it unusable. a. True b. False

a. true

"Break the glass" functionality: a. Is prohibited by the Security Rule b. Allows access privileges in limited and necessary situations c. Can be exercised only by an organization's CEO d. Does not need to be audited after the fact for appropriateness

b. Allows access privileges in limited and necessary situations

Deeming authority means: a. That accreditation exempts an organization from legal liability for acts of negligence b. An accrediting body may survey for compliance with conditions of participation c. That accreditation validates an organization's meaningful use of its electronic health record d. None of the above

b. An accrediting body may survey for compliance with conditions of participation

Which of the following rules is most likely to be utilized for noncontroversial administrative rules? a. Interim final b. Direct final rule c. Final rule d. None of the above

b. Direct final rule

A profession's Code of Ethics has the force of law. a. True b. False

b. False

Data backup will resolve all ransomware threats. a. True b. False

b. False

The Freedom of Information Act requires disclosure of health record a. True b. False

b. False

he Freedom of Information Act (FOIA) is based on the concept of: a. State government accountability b. Federal government accountability c. Open sharing of information created by private entities d. Safeguarding personally identifiable records

b. Federal government accountability

For information to be "individually identifiable" per HIPAA, it must: a. Contain the individual's name and date of birth b. Identify the person or provide a reasonable basis to believe the person could be identified c. Contain the individual's name, date of birth, and be held or transmitted by a covered entity d. Contain the individual's diagnoses

b. Identify the person or provide a reasonable basis to believe the person could be identified

A limited data set used for research: a. Is deidentified data b. Is PHI and protected by HIPAA c. Requires authorization to be disclosed d. Requires the opportunity to agree or object

b. Is PHI and protected by HIPAA

Spyware: a. Is primarily designed to propagate multiple computers b. Is primarily designed to attach to the host computer c. Includes misleading applications d. Can only be activated on unsecured wireless networks

b. Is primarily designed to attach to the host computer

A healthcare provider: a. Is always a covered entity per HIPAA b. Must conduct certain electronic transactions for HIPAA to apply c. Is not required to follow the HIPAA Security Rule d. None of the above

b. Must conduct certain electronic transactions for HIPAA to apply

To place a patient in a facility directory, a covered entity: a. Must obtain the patient's written authorization b. Must obtain the patient's verbal agreement c. Must include the patient's admission date and address d. Does not need any type of permission from the patient

b. Must obtain the patient's verbal agreement

A hospital human resources department has custody of its employees' employment records. These employment records are: a. Covered under HIPAA b. Not covered under HIPAA c. Covered under the HIPAA Privacy Rule only d. Covered under the HIPAA Security Rule only

b. Not covered under HIPAA

Ransomware: a. Consequences can be completely eliminated by data backup protocols b. Can be a virus c. Cannot be a worm d. Affects information but not system functionality

b. can be a virus

. A covered entity must act on an accounting of disclosures request within 30 days with on 30-day extension permitted. a. True b. False

b. false

The preemption doctrine requires: a. Compliance with both federal and state law when they conflict b. Compliance with state law when federal and state law conflict c. Compliance with federal law when federal and state law conflict d. Federal law to be rewritten if it conflicts with state law

c. Compliance with federal law when federal and state law conflict

Joe is on the first month of his job in a hospital IT department when the hospital's network is flooded with traffic. It becomes unusable for users trying to access information. What has occurred is: a. A power outage b. A ransomware attack c. Denial of service d. A mobile device breach

c. Denial of service

The following is identified as the person who is the subject of PHI: a. Patient b. Consumer c. Individual d. Client e. Person

c. Individual

Fifty years is a significant period of time regarding decedents' PHI. This is because decedents' records: a. Must be destroyed 50 years after death b. Must be retained 50 years after death c. Lose their PHI status 50 years after death d. May no longer be disclosed to family members 50 years after death

c. Lose their PHI status 50 years after death

Termination procedures apply: a. Only to employees b. Only to employees who are terminated involuntarily c. When a workforce member's access level changes d. None of the above

c. When a workforce member's access level changes

Maggie uses the same password for her work e-mail account, her bank account, and her gym sign-in. The gym's network has been hacked. Because she has the same password for her other accounts, her work e-mail account has also been hacked. Repeated attacks of this nature are: a. Spam b. Drive-by downloading c. Aftershock password breaches d. Denial of service

c. aftershock password breaches

Malware has infiltrated a device provides diagnostic data on cardiac patients. Which of the following are at risk? a. Confidentiality and availability b. Confidentiality and integrity c. Integrity and patient safety d. Availability and patient safety

c. integrity and patient safety

Software creators can repair a vulnerability through a: a. Virus b. Botnet c. Patch d. Trojan horse

c. patch

Encryption is an example of which control category? a. Detective b. Deterrent c. Preventive d. Reactive e. Recovery

c. preventitive

HIPAA requires that risk analysis documentation be retained: a. 10 years b. 15 years c. 5 years d. 6 years e. HIPAA does not specify

d. 6 years

The National Committee for Quality Assurance (NCQA) is most recognized for accrediting: a. Hospitals b. Physician practices c. Outpatient surgery centers d. Managed care organizations

d. Managed care organizations

hat is the right of a patient to control disclosure of his or her own health information? a. Security b. Privilege c. Access d. Privacy

d. Privacy

. Whaling is: a. Phishing directed at a specific group of people b. Malware that targets large populations of people c. A type of malware that penetrates a firewall d. Spearphishing aimed at an organization's executive

d. Spearphishing aimed at an organization's executive

Which of the following must be included in an authorization? a. Date of the individual's most recent treatment encounter b. Name of the individual's next of kin c. Date the information is to be disclosed by d. To whom the disclosure may be made

d. To whom the disclosure may be made

Which of the following destroys electronic data? a. Degaussing b. Clearing c. Physical destruction of electronic media d. All of the above

d. all of the above

Which of the following describes the processes and controls to be followed until operations are fully restored after an event? a. Business continuity plan b. Disaster recovery plan c. Data management and recovery d. Emergency mode operations plan

d. emergency mode operations

Which of the following is not a technical safeguard standard? a. Access control b. Integrity c. Transmission security d. Workstation security

d. workstation security

Organizations within a health information exchange must consider: a. How data ownership is defined b. What information will be exchanged c. How authorization will be tracked and controlled d. How user access will be authenticated e. All of the above

e. all of the above