CCE Medical Device Cybersecurity and Information Security 3

Question 1

What is the HITRUST CSF (Common Security Framework) primarily used for in healthcare organizations?

Accepted Answer

Providing a certifiable, comprehensive information risk management and compliance framework for healthcare

Answer

Tracking and managing patient health records electronically

Answer

Managing hospital financial systems and reimbursement claims

Answer

Accrediting healthcare facilities for Joint Commission certification

Question 2

Which component of HIPAA specifically establishes standards for protecting electronic protected health information (ePHI)?

Accepted Answer

HIPAA Security Rule establishing administrative, physical, and technical safeguards for ePHI

Answer

HIPAA Privacy Rule governing PHI use and disclosure

Answer

HIPAA Enforcement Rule defining penalties for violations

Answer

HIPAA Breach Notification Rule requiring notification after breaches

Question 3

What primary cybersecurity benefit does network segmentation provide for medical devices in a hospital environment?

Accepted Answer

Limits the lateral spread of cyberattacks by containing compromised devices within network segments

Answer

Increases device processing speed by reducing network congestion

Answer

Eliminates the need for device-level encryption of patient data

Answer

Automatically applies security patches to devices within the segment

Question 4

What is the primary purpose of penetration testing conducted on medical devices?

Accepted Answer

To simulate real cyberattacks to proactively identify security vulnerabilities before malicious actors exploit them

Answer

To test device electrical safety and performance under load conditions

Answer

To verify that device sterilization procedures meet regulatory compliance standards

Answer

To assess device mechanical durability under physical stress conditions

Question 5

What is the primary role of a patch management policy in medical device cybersecurity?

Accepted Answer

To establish systematic processes for evaluating, testing, and applying security updates to medical devices

Answer

To define procedures for physically labeling and tracking medical devices in inventory

Answer

To outline device procurement and capital planning procedures

Answer

To manage spare parts inventory and repair workflow for clinical equipment

Question 6

What does 'authentication' specifically ensure within a medical device access control system?

Accepted Answer

That users or systems are verified to be who they claim to be before access is granted

Answer

That all device data is encrypted during network transmission

Answer

That medical devices are physically secured to prevent theft

Answer

That network traffic to and from devices is continuously monitored

Question 7

Which of the following best describes a 'supply chain attack' in the context of medical device security?

Accepted Answer

A cyberattack that compromises medical device software or hardware during manufacturing or distribution before reaching the healthcare facility

Answer

An attack that disrupts hospital supply ordering and procurement systems

Answer

An attack that targets medical device delivery logistics and transportation

Answer

An attack on hospital inventory and supply chain management software