A healthcare organization is preparing for a HIPAA compliance audit. The compliance team has identified that several business associates have not signed updated business associate agreements (BAAs). What is the most immediate risk to the organization?

The organization must immediately notify all patients of the missing BAAs.

The business associates can legally sell PHI to third parties.

The organization will automatically lose its Medicare certification.

The organization may be held liable for the business associates' handling of protected health information (PHI) without valid BAAs.

Which of the following is a non-financial consequence of non-compliance with regulations?

Reputational damage that can lead to loss of customer trust

Increased employee productivity

Which of the following is a primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?

To govern the transfer of personal data across international borders

To establish security requirements for federal information systems

To protect cardholder data and reduce credit card fraud

To regulate the use of personal health information in the healthcare industry

What is the primary purpose of a compliance risk assessment?

To assign monetary value to all organizational assets

To design a new security architecture for the organization

To calculate the return on investment for security controls

To identify gaps between current practices and regulatory requirements

An e-commerce company based in the United States sells products to customers in the EU. The company stores customer data in the US and uses a cloud provider with data centers in the EU. Which legal obligation is most relevant to the company's handling of EU customer data?

GDPR, because the company offers goods to EU residents and processes their personal data.

HIPAA, because the company may collect health-related information from customers.

PCI DSS, because the company processes credit card payments.

The US Privacy Act, because the company is US-based.

EC-CouncilCertified Chief Information Security Officer

Domain 1Objective 3

Regulatory and Legal Compliance CCISO Practice Questions (Page 11)

Part of the Governance, Risk, and Compliance domain, which makes up ~16% of our current practice bank. EC-Council does not publish an official question count, but from its 150-minute exam (~60–100 total, ~10–16 in this domain), expect 3–4 from this objective — we provide 57 practice questions to prepare you well beyond it. (estimate)

57questions here

12free pages

9concepts

Questions 51–55

51application · medium
A healthcare organization is preparing for a HIPAA compliance audit. The compliance team has identified that several business associates have not signed updated business associate agreements (BAAs). What is the most immediate risk to the organization?
Select an answer first
52foundation · easy
Which of the following is a non-financial consequence of non-compliance with regulations?
Select an answer first
53foundation · easy
Which of the following is a primary purpose of the Payment Card Industry Data Security Standard (PCI DSS)?
Select an answer first
54foundation · easy
What is the primary purpose of a compliance risk assessment?
Select an answer first
55application · medium
An e-commerce company based in the United States sells products to customers in the EU. The company stores customer data in the US and uses a cloud provider with data centers in the EU. Which legal obligation is most relevant to the company's handling of EU customer data?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCISO

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CCISO” is a trademark of its owner, used for identification only.