CTP Digital Privacy and Security 2 — Questions and Answers
Question 1: A telehealth provider wants to use a patient's de-identified data for a quality improvement study. Under HIPAA, which standard must be met for data to qualify as truly de-identified?
- Remove only the patient's name and date of birth
- Apply the Safe Harbor method by removing all 18 specified identifiers (Correct answer)
- Obtain verbal consent from the patient before use
- Store the data on an encrypted server with access controls
Correct answer: Apply the Safe Harbor method by removing all 18 specified identifiers
HIPAA's Safe Harbor method requires removal of all 18 specified identifiers to consider health data de-identified.
Question 2: Which encryption standard is currently recommended by NIST for protecting electronic protected health information (ePHI) in transit?
- SSL 3.0
- TLS 1.2 or higher (Correct answer)
- DES (Data Encryption Standard)
- RC4
Correct answer: TLS 1.2 or higher
NIST recommends TLS 1.2 or higher for encrypting ePHI in transit, as older protocols have known vulnerabilities.
Question 3: A telehealth clinic experiences a ransomware attack that encrypts patient records. What is the FIRST action the security officer should take?
- Pay the ransom to restore access quickly
- Isolate affected systems from the network immediately (Correct answer)
- Notify all patients about the breach via email
- Restore data from backup without investigating the incident
Correct answer: Isolate affected systems from the network immediately
Isolating affected systems prevents ransomware from spreading to additional systems and is the immediate containment priority.
Question 4: Under HIPAA, how long must a covered entity retain documentation of its security policies and procedures?
- 3 years from creation or last effective date
- 6 years from creation or last effective date (Correct answer)
- 10 years from creation or last effective date
- Indefinitely
Correct answer: 6 years from creation or last effective date
HIPAA requires covered entities to retain security documentation for 6 years from the date of creation or the date it was last in effect.
Question 5: A telehealth platform uses role-based access control (RBAC). Which principle does this BEST support?
- Data integrity
- Minimum necessary access (Correct answer)
- Non-repudiation
- Data portability
Correct answer: Minimum necessary access
RBAC enforces the minimum necessary principle by granting users only the access required for their specific role.
Question 6: A patient emails their telehealth provider through a standard unsecured email service requesting medical advice. What is the provider's BEST response?
- Reply with clinical advice since the patient initiated the communication
- Ignore the email as unsecured channels cannot be used for any communication
- Reply only via a HIPAA-compliant secure messaging platform (Correct answer)
- Ask the patient to re-send the email using a different email provider
Correct answer: Reply only via a HIPAA-compliant secure messaging platform
Providers should transition communication to a HIPAA-compliant secure messaging platform to protect ePHI, regardless of how the patient initiated contact.
Question 7: What is the purpose of a Business Associate Agreement (BAA) in a telehealth setting?
- It sets billing rates between the provider and the patient
- It establishes that a vendor handling ePHI is contractually bound to HIPAA safeguards (Correct answer)
- It replaces the need for a Notice of Privacy Practices
- It authorizes the business associate to sell patient data for research
Correct answer: It establishes that a vendor handling ePHI is contractually bound to HIPAA safeguards
A BAA is a legally required contract ensuring that vendors who handle ePHI on behalf of a covered entity comply with HIPAA security and privacy rules.
CTP Digital Privacy and Security 2
A telehealth provider wants to use a patient's de-identified data for a quality improvement study.
Under HIPAA, which standard must be met for data to qualify as truly de-identified?