Become an HCISPP – HealthCare Information Security and Privacy Practitioner

test2022-11-14T07:15:23+00:00

Do you want to become a HCISPP – HealthCare Information Security and Privacy Practitioner? HCISPP is the only certification that combines cybersecurity skills with privacy best practices and techniques. It demonstrates you have the knowledge and ability to implement, manage and assess security and privacy controls to protect healthcare organizations using policies and procedures established by the cybersecurity experts at (ISC)². You can study the latest HCISPP certification exam questions to pass your HealthCare Information Security and Privacy Practitioner exam.

Try free HCISPP practice exam.

Page 1 of 8

1. Supplier-induced demand is created by:

Patients

Providers

Health insurance companies

The government

2. ___________ includes highly qualified pracitioners availble as consultants when needed.

Active

Honorary

Consulting

3. Lack of health insurance has become a middle class phenomenon among all except.

Those who are self employed

Those working in small businesses

Those with traditional jobs in manufacturing

Those with part time jobs

4. Surgeons usually receive a single payment for the surgery and postoperative care. This bundling, or payment per episode, gives surgeons an economic incentive to.

Limit both the number of surgeries they perform and the number of post operative visits they make.

Increase both the number of surgeries and the number of post operative visits.

Limit the number of surgeries and increase the number of post operative visits.

Increase the number of surgeries and limit the number of post operative visits.

5. Discovered the immunity to small pox.

Edward Jenner

Robert Koch

Hippocrates

6. If you suspect someone is violating the facility's privacy policy, you should:

Say nothing. It's none of your business.

Watch the individual until you have gathered solid evidence against them.

Report your suspicions to your clinical supervisor for further follow-up.

7. A gap analysis for the Transactions set refer to the practice of identifying the data content you currently have available

through your medical software

through your accounting software

through competing unit medical software

based on the statutory authorities report

8. Are there penalties under HIPPA?

No penalties

HIPPA calls for severe civil and criminal penalties for noncompliance, including: -- fines up to $25k for multiple violations of the same standard in a calendar year -- fines up to $250k and/or imprisonment up to 10 years for knowing misuse of individually identifiable health information.

HIPPA calls for severe civil and criminal penalties for noncompliance, includes: -- fines up to 50k for multiple violations of the same standard in a calendar year -- fines up to $500k and/or imprisonment up to 10 years for knowing misuse of individually identifiable health information

HIPPA calls for severe civil and criminal penalties for noncompliance, including: -- fines up to $100 for multiple violations of the same standard in a calendar year -- fines up to $750k and/or imprisonment up to 20 years for knowing misuse of individually identifiable health information

9. Was an early expression of medical ethics and reflected high ideals.

Cannon of Medicine

Hippocratic Oath

10. True or false: For people with Medicaid coverage, access to health care is guaranteed.

True

False

Page 2 of 8

11. Employers often advocate on behalf of their employees in benefit disputes and appeals, answer QUESTION NO:s with regard to the health plan, and generally help them navigate their health benefits.

Is this type of assistance allowed under the regulation?

The final rule does nothing to hinder or prohibit plan sponsors from advocating on behalf of group health plan participants or providing assistance in understanding their health plans.

The final rule prohibits plan sponsors from advocating on behalf of group health plan participants or providing assistance in understanding their health plans

The final rule does hinder but does not prohibit plan sponsors from advocating on behalf of group health plan participants or providing assistance in understanding their health plans

The final rule does no advocating on behalf of group health plan participants or provide assistance in understanding their health plan.

12. Which of the following actions will reduce risk to a laptop before traveling to a high risk area?

Examine the device for physical tampering

Implement more stringent baseline configurations

Purge or re-image the hard disk drive

Change access codes

13. In a free market who would pay for the delivery of health care services?

numerous health insurance companies

patients

government

multiple payers

14. Which racial/ethnic group has the highest rate of uninsurance?

White

Hispanic

Asian or pacific islander

Black or African American

15. Children under age 18 comprise approximately, what percentage of the homeless population?

40%

30%

35%

45%

16. The dramatic increase in the number of physicians since the 1970s is largely due to.

The decrease in strenuous licensing requirements

The shortage of Physician Assistants

The increase of non-primary care specialists

None of the above

17. Acts on reports and recommendations from medical staff committees.

Joint

Credentials

Ethics

Executive

18. The primary objectives of a healthcare system include all of the following except:

Enabling all citizens to receive healthcare services

Delivering healthcare services that are cost-effective

Delivering healthcare services using the most current technology, regardless of cost

Delivering healthcare services that meet established standards of quality

19. What is the meaning of the term 'Access'?

All citizens have health insurance coverage

Ability to get health care when needed

Availability of services

Employer-based health insurance

20. The single largest health profession in the United States are.

Physician Assistants

Pharmacists

Physicians

Registered nurses

Page 3 of 8

21. ___________ is one of the main objectives of HIPAA.

Secrecy

Accountability

Anonymity

Complexity

22. A patient is admitted into the E.R with 3rd degree burns through out their body. The physician on staff sends them to a burn center.

What type of care are they in?

Primary

Tertiary

Secondary

23. Which of the following are some common features designed to protect confidentiality of health information contained in patient medical records?

Locks on medical records rooms

Passwords to access computerized records

Rules that prohibit employees from looking at records unless they have a need to know

All of the above

24. Which is NOT an element of Security Awareness Training?

Determination that all staff will receive security training

Policy related to documentation of all security training

Procedural issues of who will terminate user access

Training on vulnerabilities of the electronic Protected Health Information policies

25. Title I of The Health Insurance Portability and Accountability Act protects:

Electronic health care transactions

Client's medical records

Restrictions that a group health plan can place on benefits for preexisting conditions

Health insurance coverage for workers and their families

26. A therapist's client requests an accounting of disclosures of their medical record.

What should that therapist do?

Pull the file with the accounting of disclosures for the client

Explain that disclosures are allowed as long as the client's information is deidentified or the client consents

Refer the client to the agency's Privacy Officer

Review the client's releases of information with the client

27. A person's phone number is not considered PHI because it can be located in an online or paper telephone directory.

True

False

28. When providers deliver unnecessary services with the objective of protection themselves against lawsuits, this practice is called

defensive medicine

supplier-induced demand

primary protection

legal risk

29. Health Information Rights although your health record is the physical property of the healthcare practitioner or facility that compiled it, the information belongs to you.

You do not have the right to:

obtain a paper copy of the notice of information practices upon request inspect and obtain a copy of your health record as provided for in 45 CFR 164.524

request a restriction on certain uses and disclosures of your information outside the terms as provided by 45 CFR 164.522

amend your health record as provided in 45 CFR 164.528 obtain an accounting of disclosures of your health information as provided in 45 CFR 164.528

revoke your authorization to use or disclose health information except to the extent that action has already been taken

30. Network forms of managed care organization have been referred to as "virtual integration" because.

The network is under one ownership.

The network includes hospitals and pharmacies, but not home health agencies.

The network is based on contractual relationships.

None of the above.

Page 4 of 8

31. Reviews and verifies medical staff application data.

Ethics Committee

Joint Conference

Credentials

32. True or False? The government health coverage program for the elderly and certain people with disabilities is called Medicaid.

True

False

33. Who monitors the purity of foods and safety of medicines?

Joint Commission

CMS

Medicare

FDA

34. This hospital is owned by corporations and makes up 15% of hospitals in the United States.

Government

Volunteer

Teaching

Proprietary

35. Which of the following methods MOST efficiently manages user accounts when using a third-party cloud-based application and directory solution?

Cloud directory

Directory synchronization

Assurance framework

Lightweight Directory Access Protocol (LDAP)

36. Which one of the following is NOT a fundamental component of a Regulatory Security Policy?

What is to be done.

When it is to be done.

Who is to do it.

Why is it to be done

37. Confidentiality means that data is not to be made available to unauthorized persons.

True

False

38. Administrative Safeguards on Security Awareness related to electronic Protected Health Information (PHI) and Log-in Monitoring includes all, EXCEPT:

Review the system's login reports at regular intervals

Prohibit the sharing of passwords among any employees, paid or unpaid

Limit the number of attempts a computer user can make at a log-in attempt

Use of software that locks the user out of the system after a certain number of unsuccessful log-in attempts are made

39. What is a crednetial in Health Information Management?

AAPC

ACMCS

AHIMA

40. The form of payment that is based specifically on the individual components of health care is.

Fee-for-service reimbursement.

Per Diem payment.

Reimbursement by episode of illness.

Capitation payment.

Page 5 of 8

41. In the preindustrial era, _____ often functioned as surgeons.

butchers

tailors

clergymen

barbers

42. Health Information Rights although your health record is the physical property of the healthcare practitioner or facility that compiled it, the information belongs to you. You do not have the right to:

obtain a paper copy of the notice of information practices upon request inspect and obtain a copy of your health record as provided for in 45 CFR 164.524

request a restriction on certain uses and disclosures of your information outside the terms as provided by 45 CFR 164.522

amend your health record as provided in 45 CFR 164.528 obtain an accounting of disclosures of your health information as provided in 45 CFR 164.528

revoke your authorization to use or disclose health information except to the extent that action has already been taken

43. Which of the following is a potential risk when a program runs in privileged mode?

It may serve to create unnecessary code complexity

It may not enforce job separation duties

It may create unnecessary application hardening

It may allow malicious code to be inserted

44. Regulatory strategies for health insurance financing seek to control public expenditures for health care by.

Implementing tax-financed health insurance or limiting premiums

Limiting the annual use of services among patients

Increasing competition among health insurance plans

Only A and C

45. The criminal penalties for improperly disclosing patient health information can be as high as fines of $250,000 and prison sentences of up to 10 years.

True

False

46. A risk assessment report recommends upgrading all perimeter firewalls to mitigate a particular finding.

Which of the following BEST supports this recommendation?

The inherent risk is greater than the residual risk.

The Annualized Loss Expectancy (ALE) approaches zero.

The expected loss from the risk exceeds mitigation costs.

The infrastructure budget can easily cover the upgrade costs.

47. This Hospital makes up 60% of hospitals in the United States. It is owned by religious or volunteer groups and is not for profit.

Teaching

Volunteer

Government

48. Which of the following is a true statement about both the amount and quality of medical services available:

an increase in medical services also increases the quality of care because it provides greater access to care

minimal medical services is needed for increasing quality of care because it reduces misdiagnoses

medical services can be overused or underused which can both be detrimental to the quality of care

the quantity and quality of care are not related

49. Sammy applied for and received her National Provider Identifier online.

What may she now do?

Have guaranteed payment by a health plan

Receive credentialing or licensing as a therapist provider

Be guaranteed enrollment as a provider in a health plan

Be identified as a unique health care provider during HIPAA transactions

50. True or False? Globalization of health care has produced positive effects in both developed and developing countries.

True

False

Page 6 of 8

51. In the U.S. health care system, which of the following creates a separation between financing and delivery?

Moral hazard

Phantom providers

Payment

Insurance

52. Which of the following is the BEST reason for the use of security metrics?

They ensure that the organization meets its security objectives.

They provide an appropriate framework for Information Technology (IT) governance.

They speed up the process of quantitative risk assessment.

They quantify the effectiveness of security processes.

53. Community rating is able to redistribute funds from the healthy to the sick by.

Providing benefits in excess of premiums to those who become ill.

Setting premiums based on community experience, rather than that of subgroups.

Charging the same premium for high-risk and low-risk populations.

All of the above

54. Would medical waste disposal be an example of contract services?

True

False

55. What grants a "deemed status", has conditions of participation and makes sure hospitals meet certain requirements to get reimburse for medicare/medicaid?

HIPPA

JCAH

Food and Drug Act

56. Which racial/ethnic group is growing the fastest?

White

Black or African American

Asian or Pacific Islander

Hispanic

57. True or False? In a single-payer system, the primary payer usually is an insurance company.

True

False

58. Which of the following is a PRIMARY benefit of using a formalized security testing report format and structure?

Executive audiences will understand the outcomes of testing and most appropriate next steps for corrective actions to be taken

Technical teams will understand the testing objectives, testing strategies applied, and business risk associated with each vulnerability

Management teams will understand the testing objectives and reputational risk to the organization

Technical and management teams will better understand the testing objectives, results of each test phase, and potential impact levels

59. Courtesy allows doctors to admit an occasional patient to the hospital.

True

False

60. You receive a call from staff at a local hospital stating that they need information regarding a former client of yours who is scheduled for surgery. They fax you a release of information form which only authorizes the release of medications but the person on the phone is asking for dates of treatment and diagnoses.

How would you respond?

Tell them everything they need to know because they are calling from a hospital

Release information regarding medications only

Refuse to release any information

Page 7 of 8

61. What was the function of a pest house in the preindustrial period?

To house people who had a contagious disease.

To provide refuge to those who were threatened by pests.

To eradicate pests.

To treat contagious diseases.

62. What kind of personally identifiable health information is protected by HIPAA privacy rule?

Paper

Electronic

The spoken word

All of the above

None of the above

63. Who believed that the only was to understand a disease was to examine the cells of the affected body?

Lister

Flemming

Koch

Virchow

64. The cost controlling strategy that attempts to influence physician behavior by denying payment for services deemed unnecessary is called.

Supply limits

Utilization management

Patient cost sharing

Aggregate unites of payment

65. Which of the following disaster recovery test plans will be MOST effective while providing minimal risk?

Read-through

Parallel

Full interruption

Simulation

66. ______________- medicine believed gods and evil spirits caused disease.

Ancient

Prehistoric

Modern

67. What time period was syphilis an epidemic?

Renaissance

Ancient

Modern

68. Jackson broke his ankle while performing with his band 100 Monkeys. Jackson was rushed to the E.R and from there he was referred to a bone specialist.

What type of care is Jackson in?

Quaternary

Primary

Secondary

69. Which of the following factors was particularly important in promoting the growth of office-based medical practice in the postindustrial period?

Urbanization

Educational reform

Science and technology

Dependency

licensing

70. Since the early 1900s, the burden of disease in developed countries has shifted.

to underdeveloped countries

from infectious to chronic disease

from chronic to infectious disease

from the rich to the poor

Page 8 of 8

71. The inception of _____ was used as a trial balloon for the idea of government-sponsored universal health insurance.

workers' compensation

trade unions

public health

health care for the veterans

72. Under HIPAA, what is the entity that processes healthcare claims and performs related functions for a health plan?

Policy Advisory Group

Third Party Administrator

Joint Commission on Accreditation of Healthcare Organizations

Plan Sponsor

73. If a client requests a restriction for disclosure of a certain part of their PHI to a health plan, the health care provider is:

Required to agree to the requested restriction if the disclosure is for treatment or payment, is not required by law, and if the information is specifically related to a health care item or service that the client has paid for in full

Required to agree only if the client specifies why he/she wants the restriction

Required to agree only if the client specifies who he/she wants the restriction to apply to

Required to agree to the requested restriction

74. Which of the following types of business continuity tests includes assessment of resilience to internal and external risks without endangering live operations?

Walkthrough

Simulation

Parallel

White box

75. Group Health Plans sponsored or maintained by employers, however,

ARE SOMETIMES covered entities.

ARE NOT covered entities.

ARE covered entities

ARE called uncovered entities

76. A medical intervention lying on a steeper portion of the aggregate cost-benefit curve indicates a major benefit for a relatively modest cost.

An example of such an intervention would be:

childhood immunizations.

lung transplants.

care for an anencephalic infant.

purchasing MRI scanners to supplement CT scanners.

77. A health plan may conduct its covered transactions through a clearinghouse, and may require a provider to conduct covered transactions with it through a clearinghouse. The incremental cost of doing so must be borne

by the HIPPA authorities

by the health plan

by any other entity but the health plan

by insurance companies