HCISPP Third-Party Risk Management Questions and Answers

Question 1

A hospital's Business Associate Agreement (BAA) with a cloud storage provider includes a 'Termination for Cause' clause. Under what circumstance is the hospital MOST likely to invoke this clause?

Accepted Answer

The provider refuses to return or destroy the hospital's ePHI after the contract ends.

Answer

The provider increases their service fees by 5% as allowed in the contract.

Answer

The provider experiences a minor service outage that lasts for 30 minutes.

Answer

The hospital decides to switch to a different cloud provider for better pricing.

Question 2

A healthcare clearinghouse (a business associate) hires a data analytics firm (a subcontractor) to process claims data containing PHI. According to HIPAA, what is the primary responsibility of the clearinghouse regarding this subcontractor?

Accepted Answer

To ensure the subcontractor signs a BAA that mirrors the same obligations the clearinghouse has.

Answer

To notify the original covered entities about the new subcontractor relationship.

Answer

To conduct a one-time security assessment of the subcontractor.

Answer

To obtain patient consent before allowing the subcontractor to access PHI.

Question 3

Which of the following activities is a critical component of the 'Ongoing Monitoring' phase of the third-party risk management lifecycle in a healthcare setting?

Accepted Answer

Conducting periodic risk re-assessments and performance reviews.

Answer

Performing initial due diligence and security assessments.

Answer

Negotiating the terms of the Business Associate Agreement.

Answer

Ensuring the secure destruction or return of all ePHI.

Question 4

A medical transcription service (business associate) discovers that one of its employees emailed a batch of patient records to their personal, unsecured email account. The transcription service's BAA with the hospital requires it to report security incidents. What is the business associate's MOST immediate obligation?

Accepted Answer

Report the incident to the hospital without unreasonable delay.

Answer

Wait to see if the data is misused before reporting.

Answer

Immediately terminate the employee responsible for the breach.

Answer

Notify the affected patients directly on behalf of the hospital.

Question 5

When a healthcare organization is evaluating a potential vendor's security posture during the due diligence phase, which of the following provides the highest level of assurance for ongoing compliance?

Accepted Answer

A SOC 2 Type 2 report.

Answer

A completed self-assessment questionnaire from the vendor.

Answer

A marketing brochure detailing their security features.

Answer

A point-in-time vulnerability scan.

Question 6

A hospital is terminating its contract with a third-party vendor that stored ePHI. The BAA stipulates that the vendor must destroy all ePHI. What is the hospital's most crucial final step in the offboarding process?

Accepted Answer

Obtaining a certificate or written confirmation of data destruction.

Answer

Negotiating a discount on the final invoice.

Answer

Revoking the vendor's physical access to the hospital.

Answer

Publishing a press release about the end of the partnership.