Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Compliance > HIPAA Lesson 7 > Flashcards

HIPAA Lesson 7 Flashcards

1
Q

What are the three rules of the Administrative Simplification?

A
  1. Standards for Electronic Transactions, Code Sets, and Identifiers
  2. The Privacy Rule
  3. The Security Rule
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

_______ means having controls, countermeasures, and procedures in place to ensure the appropriate protection of your information assets.

A

Security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

In the 1990s, governmental organizations from Canada, France, Germany, the Netherlands, the United Kingdom, and the United States created the _______.

A

Common Criteria

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Good security _______ the vulnerability of assets and resources.

A

minimizes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

An ______ is anything of value.

A

asset

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

______ is any weakness that someone could exploit to violate a system or the information it contains.

A

Vulnerability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

A ______ is a potential violation of security.

A

threat

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

In the Common Criteria model, ______ include all those who are accountable for or place value on the assets in question.

A

owners

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

______ seek to abuse or damage assets. Owners assume that the threats may harm the assets in a way that will reduce their value.

A

Threat agents

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

______ is the danger of various threats and attacks on an organization’s assets.

A

Risk

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

______ is the process of proving your identity to a system or network.

A

Authentication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The authentication processes that uses a person’s physical traits, like a thumbprint or retinal scan, to confirm identity.

A

Biometrics

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

______ ensures that only authorized users access a system and rejects (repudiates) all unauthorized users.

A

Access control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

______ ensures the privacy of data on the system and network.

A

Data confidentiality

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

______ assures that data hasn’t been altered or destroyed in any unauthorized manner—either accidentally, intentionally, or due to some type of system failure.

A

Data integrity

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

______ means that you make a copy of your data to protect against data loss.

A

Data Backup and Recovery

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

______ can result from environmental hazards like a flood or fire, failed hard drives or other media, or accidental deletion of data.

A

Data loss

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

______ is the denial of access to a system, such as entering your password incorrectly and being denied access to an account?

A

Repudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

______ of an access attempt means that it’s possible to verify the user’s identity and allow him or her to access the system, such as entering your password correctly and gaining access to your account.

A

Nonrepudiation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

List the three components of Risk management: (AUE)

A
  1. Analyzing the results of the required risk assessment
  2. Updating policies, procedures, and practices to protect against identified threats and vulnerabilities
  3. Enforcing appropriate security program requirements
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

______ means collecting data and evaluating the effectiveness of the business’s security program. Audit data includes logs, predefined reports, reports related to threats, vulnerabilities identified during risk assessment, policies and procedures, and so on.

A

Audit and system monitoring

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

The “system” part of audit and system monitoring means checking the information technology system you’re using. List several goals to keep in mind here: (P-DISC)

A
  • Apply patches (fixes) as necessary.
  • Make sure security is in place and working properly.
  • Confirm that data is available as needed.
  • Keep data confidential.
  • Protect the integrity of the data. In other words, make sure it isn’t stolen, tampered with, degraded, or lost.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

List the two types of security mechanisms:

A

Specific and Pervasive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

______ apply to specific functions or processes, like encryption or access authentication.

A

Specific security mechanisms

25
Q

______ apply system wide, regardless of function, like audit trails and backup and recovery processes.

A

Pervasive mechanisms

26
Q

______ provides confidentiality of data.

A

Encryption

27
Q

______ on messages electronically simulate handwritten signatures, which provide authentication of messages, especially when you use them with encryption.

A

Digital signatures

28
Q

_____ allow authorized users to use a system and block unauthorized users.

A

Access control mechanisms

29
Q

______ include time stamping, sequence numbering, and cryptographic chaining. All of these can ensure the integrity of data units or fields.

A

Data integrity mechanisms

30
Q

The computer operating system automatically marks the date and time a file or information in the database was viewed or modified.

A

Time stamping

31
Q

Each data field or file in a database gets its own number in a certain order. A missing block of numbers means there’s been a breach or error.

A

Sequence numbering

32
Q

A “key” is encrypted within blocks of data in an operating system, database, or file. The key links blocks of information together. If a key is missing or modified, that indicates a breach in data integrity.

A

Cryptographic (cipher block) chaining

33
Q

List the three authentication methods: (SY-HAK)

A
  • Something you know (username and password),
  • Something you have (a token, like a SecurID card token),
  • Something you are (biometric information, like fingerprints or voiceprints).
34
Q

______ provide the same services as a notary public. A trusted third-party entity uses an underlying protocol or mechanism to verify a given data transaction.

A

Notarization mechanisms

35
Q

List the specific security mechanisms: (DEA DAN)

A
  • Encryption
  • Digital Signatures
  • Access Control Mechanisms
  • Data Integrity
  • Authentication Information
  • Notarization Mechanisms
36
Q

List the two most common pervasive security mechanisms:

A
  • Audit Trails

* Security Recovery

37
Q

An ______ is a record of key activities within a system.

A

audit trail

38
Q

______ is an automated feature of some systems that helps you recover system software if the system fails or crashes.

A

Security Recovery

39
Q

A ______ is the danger of an attack or disruption that could compromise an organization’s information, systems, and technology infrastructure.

A

threat

40
Q

These threats have no premeditated intent.

A

Accidental threats

41
Q

These threats may be as simple as a casual examination of computer or network data, or can be a sophisticated attack using special system knowledge and advanced tools to steal confidential information.

A

Intentional threats

42
Q

These threats do not modify any information in the system.

A

Passive threats

43
Q

If a threat involves altering information, changing the state or operation of the system, or changing how the program works, it is called an _______.

A

active threat

44
Q

List the most common types of attacks on computer systems: (MISS-PD)

A
  • Malicious Software
  • Spoofing
  • Denial of Service (DoS)
  • Password cracker applications
  • Insider (internal) attacks
  • Social Engineering
45
Q

This term refers to viruses, worms, Trojan horses, and backdoor programs, all of which intentionally reroute, alter, or destroy information.

A

Malicious software / malware

46
Q

_____ happens when an entity falsely assumes the identity of another entity. In other words, a fraudster might send out emails that look like they came from a local hospital.

A

Spoofing

47
Q

______ is a common way to obtain information useful for committing identity theft.

A

Phishing

48
Q

______ attacks can compromise the use of hundreds or even thousands of systems to launch multiple attacks.

A

Distributed Denial of Service (DDoS)

49
Q

A ______ attack results in the overload of a resource, such as disk space, network bandwidth, internal tables of memory, or input buffers. The overload means that the resource is unavailable for others to use.

A

Denial of Service (DoS )

50
Q

A _______ is any program that compromises security by revealing passwords.

A

password cracker application

51
Q

These attacks happen when legitimate users of a system behave in unintended or unauthorized ways.

A

Insider (internal) attacks

52
Q

About ______% of inappropriate access to data occurs within an organization.

A

85%

53
Q

_____ is someone who pretends to be someone he or she isn’t and cons his or her way into getting information.

A

Social Engineering

54
Q

______ is a violation of the organization’s security policies or technologies.

A

Security Breach

55
Q 
Several nations joined to create a general security understanding known as what? 
• The Common Criteria. 
• Minimum Necessary. 
• The Security Rule. 
• The Privacy Rule.
A

The Common Criteria

56
Q

How does the Security Rule define a threat?
• A potential violation of security.
• An entity that impersonates another entity.
• A weakness that someone could exploit to violate a system.
• A record of key activities within a system.

A

A potential violation of security.

57
Q 
What's the correct name for the process by which you prove your identity to a system? 
• Access control. 
• Repudiation. 
• Data confidentiality. 
• Authentication.
A

Authentication

58
Q

What is an accidental threat?
• One that results in no modification to any data.
• One that alters data.
• A threat that has no premeditated intent.
• A casual examination of computer data by someone who isn’t supposed to have access to it.

A

A threat that has no premeditated intent

59
Q 
Which type of attack can you protect against by training people rather than by altering or reprogramming computers? 
• Insider (internal) attack. 
• Malicious software. 
• Denial of service (DoS). 
• Social engineering.
A

Social engineering

Compliance (12 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions