Compliance Standards (PCI DSS, HIPAA, GDPR) CEH Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A hospital's billing department receives a phone call from a patient's employer requesting the patient's treatment dates to verify an insurance claim. The employer does not have a signed authorization from the patient. Under the HIPAA Privacy Rule, what should the billing department do?

   • ADeny the request unless the patient provides a signed authorization or the disclosure is otherwise permitted by law.
   • BDeny the request because the employer is not a healthcare provider or health plan.
   • CProvide the dates because the request is for payment purposes and is a permitted disclosure.
   • DProvide the dates because the employer is paying for the insurance and has a legitimate need.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A multinational corporation with headquarters in the EU processes personal data of EU residents. The corporation is considering transferring the data to a subsidiary in a country that the European Commission has not deemed adequate. What must the corporation do to ensure the transfer complies with GDPR?

   • ATransfer the data because the subsidiary is part of the same corporation.
   • BUse standard contractual clauses (SCCs) approved by the European Commission.
   • CObtain consent from each data subject before transferring the data.
   • DAnonymize the data before transfer, so GDPR does not apply.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A data controller fails to maintain records of processing activities as required by GDPR. The supervisory authority determines that this is a violation. What is the maximum fine that can be imposed for this specific violation?

   • A€50 million or 5% of the company's global annual turnover, whichever is higher.
   • B€20 million or 4% of the company's global annual turnover, whichever is higher.
   • C€10 million or 2% of the company's global annual turnover, whichever is higher.
   • DNo fine can be imposed because record-keeping is an administrative obligation.
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A hospital is implementing a new patient portal that allows patients to view their health records and communicate with their doctors. The hospital wants to ensure that the portal complies with HIPAA. Which combination of measures is most appropriate?

   • AObtain written consent from each patient before they can use the portal.
   • BEnsure that all patient data is anonymized before being displayed in the portal.
   • CImplement strong authentication, encrypt data in transit, and conduct a risk analysis.
   • DAllow patients to access the portal only through a secure VPN connection.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Under the HIPAA Breach Notification Rule, when must a covered entity notify affected individuals of a breach of unsecured PHI?

   • AWithin 10 business days of the breach
   • BWithout unreasonable delay and in no case later than 60 days after discovery of the breach
   • CWithin 30 days after the end of the calendar year
   • DOnly if the breach affects more than 500 individuals
   Reveal Solution Discussion Select an answer first