HIPAA Lesson 8

Question 1

According to the Computer Crime and Security Survey, which of these is the most common form of computer attack or abuse?
o Computer viruses.
o Security breaches that lead to significant financial losses.
o Internal employee abuse.
o Denial of service (DoS) attacks.

Answer 1

Computer viruses.

Question 2

When you're talking about the Security Rule, what's the correct name for standards that work for large and small organizations? 
o Best practices. 
o Technology-neutral. 
o Comprehensive. 
o Scalable.

Answer 2

Scalable.

Question 3

Which term best matches this definition? "The security principle that means valued information assets are free from unauthorized modification or destruction." 
o  Integrity. 
o  Confidentiality. 
o  Availability. 
o  Addressable.

Answer 3

Integrity.

Question 4

What's the correct name for the strategy of implementing controls that reduce the causes of risk? 
o  Risk assumption. 
o  Risk transference. 
o  Risk elimination. 
o  Risk mitigation.

Answer 4

Risk mitigation.

Question 5

When you're conducting a risk assessment, what should be your final step? 
o Vulnerability identification. 
o Threat identification. 
o Risk determination. 
o System or asset criticality analysis.

Answer 5

Risk determination.

Question 6

The Computer Security Institute concludes that ______ attacks continue to be the source of the greatest financial losses. Further, there’s been a significant increase in _______ access, which is now the second-most-significant contributor to computer crime losses.

Answer 6

1. virus

2. unauthorized

Question 7

______ are the methods that have proven most effective over time.

Answer 7

Best practices

Question 8

The Security Rule creators developed the philosophy that the Security Rule should be _____, _____, and _____.

Answer 8

1. comprehensive
2. technology-neutral
3. scalable

Question 9

Encompassing all areas of the organization.

Answer 9

Comprehensive

Question 10

List the security standards three main categories:

Answer 10

1. administrative controls
2. physical controls
3. technical controls.

Question 11

_____ is a not-for-profit organization that sets standards for all sorts of technology fields.

Answer 11

NIST (National Institute for Standards & Technology)

Question 12

Protection of valued information assets from unauthorized disclosure.

Answer 12

Confidentiality

Question 13

Unbiased about whose technology or whose software product an organization uses.

Answer 13

Technology-neutral

Question 14

Rules and procedures that work just as well for a few users as they do for many.

Answer 14

Scalable

Question 15

Free from unauthorized modification or destruction.

Answer 15

Integrity

Question 16

Obtainable to those who have authorization to access it when they need it.

Answer 16

Availability

Question 17

The Security Rule has ____ standards.

Answer 17

18

Question 18

These specifications provide details about how to comply with the Security standards.

Answer 18

Implementation specifications

Question 19

A _____ implementation specification means that an organization has to implement the specification, no matter what the organization does or what sized it is.

Answer 19

Required

Question 20

_____ implementation specifications give CEs some flexibility for compliance with the security standards. A covered entity must first do its own risk ______ and create its own risk ______ strategy. It must also ______ the security measures already in place and consider the _____ of implementation.

Answer 20

1. Addressable
2. analysis
3. mitigation
4. assess
5. cost

Question 21

______ cannot be the sole reason for not adopting an implementation specification.

Answer 21

Cost

Question 22

The Security Management Process contains which risk implementation specifications.

Answer 22

1. Risk Analysis

2. Risk Management

Question 23

Risk can be a ______ or ______ measure.

Answer 23

quantitative

qualitative

Question 24

A risk measure that uses a mathematical process and assigned weights and numbers.

Answer 24

Quantitative

Question 25

Risk can be a ______ measure of the likelihood of a particular threat affecting a particular vulnerability, and the resulting impact that it would have.

Answer 25

Qualitative (non-numerical)

Question 26

What Are the Sources of Threats to Protected Health Information?

Answer 26

1. Human: hackers, viruses, unintentional deletion, deliberate attacks, unauthorized access 2. Natural: floods, earthquakes, tornadoes, fires, lightning strikes 3. Environmental: long-term power failure, broken water pipes, heat or air-conditioning problems

Question 27

List the key steps for conducting a Risk Assessment.

Answer 27

1. System or asset criticality analysis: How important is the system and the data on it? 2. Threat identification: What can damage the confidentiality, integrity, or availability of the data on this system? 3. Vulnerability identification: What weaknesses in the system make it susceptible to effects of a given threat? 4. Control analysis: What safeguards are in place? 5. Likelihood determination: What are the odds that a given threat will happen? 6. Impact analysis: What will happen if a threat occurs? 7. Risk determination: Based on how you answered the previous questions, what is your quantitative or qualitative measure of risk?

Question 28

List the four risk strategies.

Answer 28

1. Risk Assumption 2. Risk Mitigation 3. Risk Avoidance 4. Risk Transference

Question 29

Accept the risk as it is.

Answer 29

Risk Assumption

Question 30

Put controls in place that will offset the risk or reduce the harmful effects of the threat.

Answer 30

Risk Mitigation

Question 31

Implementing controls that eliminate the cause of the risk.

Answer 31

Risk Avoidance

Question 32

Transfer the risk to someone else.

Answer 32

Risk Transference

Question 33

______ is this overall process of risk assessment and risk mitigation.

Answer 33

Risk management

Question 34

After you complete your risk mitigation, there will still be vulnerabilities. This is the _______ level of risk to your assets.

Answer 34

residual

Question 35

You can never eliminate all risks. You can only reduce them to an _______ level.

Answer 35

acceptable

Question 36

Determine each risk strategy used below when an individual purchases a laptop: 1. Installed antivirus software 2. Accepted risk of not installing antivirus software 3. Didn't connect the laptop to the Internet 4. Bought insurance to cover costs if someone hacks into the laptop

Answer 36

1. Risk Mitigation 2. Risk Assumption 3. Risk Avoidance 4. Risk Transference