A healthcare provider is implementing the HIPAA Security Rule and needs to protect ePHI in its new telehealth platform. The platform allows patients to video-conference with doctors and store medical records. The provider is concerned about both data confidentiality and data integrity during transmission. Which combination of safeguards should the provider implement?

Unique user identification and automatic logoff for all users.

Encryption for data in transit and integrity controls to verify that data has not been altered.

Security awareness training and contingency planning.

Facility access controls and workstation security policies.

Under the HIPAA Privacy Rule, which of the following is a permitted use or disclosure of PHI without patient authorization?

Disclosure to a public health authority for disease control purposes

Disclosure to a marketing company for promotional purposes

Disclosure to an employer for employment decisions

Disclosure to a journalist for a news story

Which PCI DSS requirement specifically addresses restricting physical access to cardholder data?

Requirement 9: Restrict physical access to cardholder data

Requirement 12: Maintain a policy that addresses information security for all personnel

Requirement 5: Use and regularly update anti-virus software

Requirement 10: Track and monitor all access to network resources and cardholder data

A mid-sized EU company is planning to deploy a new customer relationship management (CRM) system that will process the personal data of its customers, including sensitive data such as health information. The company's data protection officer (DPO) is unsure whether a data protection impact assessment (DPIA) is required. What should the DPO do?

Conduct a DPIA because the processing involves sensitive data and is likely to result in a high risk to individuals.

Skip the DPIA because the company has a DPO and the processing is for customer relationship management.

Obtain consent from all customers before proceeding, and no DPIA is needed.

Conduct a DPIA only if the CRM system is cloud-based.

EC-CouncilCertified Ethical Hacker

Domain 1Objective 9

Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 6)

Part of the Information Security and Ethical Hacking Overview domain, which makes up ~17% of our current practice bank. EC-Council does not publish an official question count, but from its 240-minute exam (~95–160 total, ~16–27 in this domain), expect 2–3 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

12concepts

Questions 26–30

26expert · hard
A healthcare provider is implementing the HIPAA Security Rule and needs to protect ePHI in its new telehealth platform. The platform allows patients to video-conference with doctors and store medical records. The provider is concerned about both data confidentiality and data integrity during transmission. Which combination of safeguards should the provider implement?
Select an answer first
27foundation · easy
Under the HIPAA Privacy Rule, which of the following is a permitted use or disclosure of PHI without patient authorization?
Select an answer first
28foundation · easy
Which PCI DSS requirement specifically addresses restricting physical access to cardholder data?
Select an answer first
29application · medium
A mid-sized EU company is planning to deploy a new customer relationship management (CRM) system that will process the personal data of its customers, including sensitive data such as health information. The company's data protection officer (DPO) is unsure whether a data protection impact assessment (DPIA) is required. What should the DPO do?
Select an answer first
30foundation · easy
A merchant processes 2 million Visa transactions per year. According to the PCI DSS compliance levels, which level does this merchant fall into?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CEH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CEH” is a trademark of its owner, used for identification only.

Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 6)

Questions 26–30

Under the HIPAA Privacy Rule, which of the following is a permitted use or disclosure of PHI without patient authorization?

Which PCI DSS requirement specifically addresses restricting physical access to cardholder data?

A merchant processes 2 million Visa transactions per year. According to the PCI DSS compliance levels, which level does this merchant fall into?

Keep studying — Information Security and Ethical Hacking Overview