Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is considered protected health information (PHI) under HIPAA?

   • AA patient's first name only, without any other context
   • BAn employee's work schedule at a hospital
   • CA hospital's financial revenue data
   • DA patient's name combined with their medical diagnosis
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A healthcare provider is implementing the HIPAA Security Rule and needs to ensure that only authorized personnel can access electronic protected health information (ePHI) in its new EHR system. The provider also wants to verify that ePHI has not been altered during transmission between facilities. Which combination of safeguards should the provider implement?

   • AAdministrative safeguards: security awareness training and contingency planning.
   • BTechnical safeguards: encryption and audit controls.
   • CPhysical safeguards: facility access controls and workstation security.
   • DTechnical safeguards: unique user identification and integrity controls.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A health insurance company discovers that a hacker accessed the unencrypted personal health information of 800 individuals in a single state. Under the HIPAA Breach Notification Rule, what notifications must the company make?

   • ANotify only affected individuals within 60 days; HHS and media notification are not required.
   • BNotify HHS within 60 days and the media, but individual notification is not required because the data was not used.
   • CNotify affected individuals within 30 days and HHS within 60 days.
   • DNotify affected individuals and HHS within 60 days, and notify the media if more than 500 residents of the state are affected.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A covered entity's laptop containing unencrypted electronic protected health information (ePHI) is stolen from an employee's car. The entity determines that the laptop was not accessed and the data was not actually viewed. Under the HIPAA Breach Notification Rule, what is the entity required to do?

   • ANotify the media because the theft involved a device that could affect more than 500 individuals.
   • BConduct a risk assessment to determine the probability that PHI was compromised; if low, no notification is required.
   • CReport the incident to HHS immediately, but no individual notification is needed because the data was not viewed.
   • DNotify affected individuals and HHS within 60 days because the device was stolen.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   PCI DSS compliance levels are primarily determined by which factor?

   • AThe type of card brands accepted (e.g., Visa, Mastercard)
   • BThe geographic location of the organization's headquarters
   • CThe annual volume of card transactions processed by the organization
   • DThe number of employees in the organization
   Reveal Solution Discussion Select an answer first