A hospital's IT department wants to ensure that only authorized personnel can access electronic protected health information (ePHI) in the electronic health record (EHR) system. Which combination of safeguards should the IT department implement to meet the HIPAA Security Rule's requirements?

Encrypt all ePHI at rest and in transit.

Install surveillance cameras in the data center.

Implement role-based access controls and unique user identification.

Conduct regular security awareness training for all staff.

A hospital's marketing department requests access to patient records to identify individuals who might be interested in a new wellness program. The department wants to send promotional emails to patients with a history of cardiac conditions. Under the HIPAA Privacy Rule, which action must the hospital take before allowing this use of protected health information (PHI)?

Allow the use because marketing is a permitted healthcare operation under HIPAA.

Obtain a signed authorization from each patient before using their PHI for marketing purposes.

Require the marketing department to sign a business associate agreement (BAA) before accessing PHI.

De-identify the patient records so that no individual can be identified before sharing the data.

Under the GDPR, what is the maximum fine for the most severe violations, such as processing data without a legal basis?

€20 million or 4% of the company's global annual turnover, whichever is higher

€5 million or 1% of the company's global annual turnover, whichever is higher

€50 million or 10% of the company's global annual turnover, whichever is higher

€10 million or 2% of the company's global annual turnover, whichever is higher

An EU data subject submits a request to an online retailer to delete all personal data the retailer holds about them. The retailer has processed the data subject's orders and is required by EU tax law to retain transaction records for 10 years. How should the retailer respond?

Delete the personal data that is not required for legal compliance, but retain the transaction records as required by tax law.

Refuse the request entirely because the retailer has a legal obligation to retain the data.

Anonymize the transaction records and then delete the personal data.

Delete all personal data immediately because the data subject has an absolute right to erasure.

EC-CouncilCertified Ethical Hacker

Domain 1Objective 9

Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 3)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 11–15

11application · medium
A hospital's IT department wants to ensure that only authorized personnel can access electronic protected health information (ePHI) in the electronic health record (EHR) system. Which combination of safeguards should the IT department implement to meet the HIPAA Security Rule's requirements?
Select an answer first
12foundation · easy
Under the GDPR, which right allows a data subject to receive their personal data in a structured, commonly used, and machine-readable format?
Select an answer first
13application · medium
A hospital's marketing department requests access to patient records to identify individuals who might be interested in a new wellness program. The department wants to send promotional emails to patients with a history of cardiac conditions. Under the HIPAA Privacy Rule, which action must the hospital take before allowing this use of protected health information (PHI)?
Select an answer first
14foundation · easy
Under the GDPR, what is the maximum fine for the most severe violations, such as processing data without a legal basis?
Select an answer first
15application · medium
An EU data subject submits a request to an online retailer to delete all personal data the retailer holds about them. The retailer has processed the data subject's orders and is required by EU tax law to retain transaction records for 10 years. How should the retailer respond?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 3)

Questions 11–15

A hospital's IT department wants to ensure that only authorized personnel can access electronic protected health information (ePHI) in the electronic health record (EHR) system. Which combination of safeguards should the IT department implement to meet the HIPAA Security Rule's requirements?

Under the GDPR, which right allows a data subject to receive their personal data in a structured, commonly used, and machine-readable format?

Under the GDPR, what is the maximum fine for the most severe violations, such as processing data without a legal basis?

An EU data subject submits a request to an online retailer to delete all personal data the retailer holds about them. The retailer has processed the data subject's orders and is required by EU tax law to retain transaction records for 10 years. How should the retailer respond?

Keep studying — Information Security and Ethical Hacking Overview