Compliance, Ethics, and Culture CGEIT Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A healthcare organization's IT governance committee is evaluating a proposal to use de-identified patient data for a research project that could improve treatment outcomes. The data is technically de-identified under HIPAA, but the committee is concerned about the ethical implications of using data without explicit patient consent. Which decision-making approach best balances ethical and compliance considerations?

   • AApprove the project with additional safeguards, such as an independent ethics review and a transparency notice to patients.
   • BApprove the project because the data is de-identified and HIPAA permits its use without consent.
   • CDefer the decision until legal counsel provides a formal opinion on the HIPAA requirements.
   • DReject the project because using patient data without consent violates the principle of respect for persons.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   What is the purpose of using an ethical decision-making framework in IT governance?

   • ATo guarantee that the most profitable option is always selected.
   • BTo eliminate the need for stakeholder input.
   • CTo ensure that all decisions are made by the legal department.
   • DTo provide a structured approach for evaluating the ethical implications of decisions.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary purpose of a compliance risk assessment in IT governance?

   • ATo assign blame to individuals for past compliance failures.
   • BTo guarantee that all compliance risks are eliminated.
   • CTo identify potential areas where the enterprise might fail to meet legal or regulatory requirements.
   • DTo replace the need for ongoing compliance monitoring.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A technology company has a culture that rewards rapid feature delivery, often at the expense of documentation and security reviews. The IT governance team wants to improve compliance with internal security standards. Which approach is most likely to be effective?

   • AIncrease the frequency of internal audits and publish non-compliance findings to the entire company.
   • BAlign performance metrics and incentives to include security and compliance milestones, not just feature velocity.
   • CIntroduce a mandatory security review gate in the development pipeline that blocks releases without sign-off.
   • DReplace the current development methodology with a more formal waterfall process to ensure documentation is completed.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A cloud service provider (CSP) offers infrastructure-as-a-service to healthcare clients. The CSP is not a covered entity under HIPAA, but its clients are. The CSP wants to support its clients' compliance. Which responsibility is most appropriate for the CSP to assume?

   • AConduct annual security audits of its infrastructure and share the results with all clients.
   • BProvide a self-service portal where clients can manage their own security controls.
   • CEnsure that all client data is encrypted at rest and in transit, and provide the encryption keys to clients.
   • DSign business associate agreements (BAAs) with clients and implement safeguards required for business associates.
   Reveal Solution Discussion Select an answer first