Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

HCISSP ISC2 > Quiz 3 > Flashcards

Quiz 3 Flashcards

1
Q

Core Functions of IT Department: Operations and Tech Support

A
  • Manage the IT Infrastructure (servers, networks, operating systems, databases, workstations)
  • Troubleshoot and repair infrastructure
  • Install new technology
  • Update existing software
  • Perform backups
  • Respond to user problems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Core Functions of IT Department: Applications Management

A
  • Manage the process of acquiring new systems
  • Developing and implementing new systems
  • Ongoing Enhancement
  • Troubleshooting
  • Working with application vendors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Core Functions of IT Department: Specialized Groups

A

Dependent on the organization, for example:

  • Support of research community in academic medical centers
  • Process redesign groups
  • Decision-support groups
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Core Functions of IT Department: IT Administration

A
  • Oversee the development of the IT strategic plan
  • Manages contracts with vendors
  • Handles the IT budget
  • Provides HR support for IT staff
  • Manages the space occupied by the IT department
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Chief Information Officer (CIO)

A

An Executive who can successfully lead the organization in its effort to apply IT in its strategic advancement

-Manages the IT department

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Chief Technology Officer (CTO)

A
  • Defines technology standards
  • Ensures currency of the IT infrastructure
  • Ensures the fitness of IT solutions

-Tracks emerging technologies and identifies those which may prove useful to the organization

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Chief Security Officer (CSO)

A
  • Ensures the organization has a effective information security plan
  • Ensures appropriate procedures are in place to safeguard the system from tampering and misuse
  • Disaster recovery protocols are established
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Chief Medical Information Officer (CMIO)

A

A role, typically filled part-time by a physician,that ensures the adoption of appropriate clinical information systems.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Key Attributes of a High-Performing CIO

A

1) Set vision and strategy
2) Integrates IT for business success
3) Makes changes happen
4) Builds technological confidence
5) Partners with customers
6) Ensures IT talent
7) Builds networks and community

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IT Staff Roles: Project Leader

A

Manages IT projects, such as: implementations and deployment of infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IT Staff Roles: System Analyst

A

Works closely with end users and their managers to:

  • Identify IT system needs and problems
  • Evaluate workflow
  • Determine strategies for optimization

Also, prepares cost-benefit and ROI analyses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IT Staff Roles: Programmer

A

Writes, tests and maintains the programs within a system; conceives, designs, and tests logical structures for solving problems via technology.

Two main types:

  • Applications
  • Systems
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

IT Staff Roles: Applications Programmer

A
  • Writes programs to handle specific user tasks
  • Revises existing packaged software
  • Customizes generic applications
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

IT Staff Roles: Systems Programmer

A

Writes programs that control the infrastructure’s software.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

IT Staff Roles: Database Administrator

A

Works with database management systems to determine ways to organize and store data, while ensuring optimal performance.

-Plans and coordinates security measures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

IT Staff Roles: Network Administrator

A

Designs, tests, and evaluates data communication systems. (e.g. Internet or LAN networks)

-Performs network modeling: researching related products in order to provide hardware or software recommendations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Key Attributes of High-Quality IT Staff

A
  • They execute well
  • They are good consultants
  • They provide world-class support
  • They stay current in their field of expertise
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Centralization of IT Services: Benefits

A
  • Enforcement of hardware and software Standards
  • Efficient Administration of Resources
  • Better Staffing
  • Easier Training
  • Effective Planning of Shared Systems
  • Easier Strategic IT Planning
  • Tighter Control by Senior Management
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Decentralization of IT Services: Benefits

A
  • Better fit of IT-to-Business needs
  • Quick response times
  • Encouragement of end user development of applications
  • Innovative use of information systems.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Core IT Competencies

A
  • A small number of areas are identified by the organization as Core Competencies.
  • Affects the formation and focus of an IT department
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Departmental Attributes: Agility

A

The ability to form and disband teams quickly (~3mo) as staff move from project to project.

  • Requires flexibility in an organization’s structural and reporting relationships
  • Project managers are temporary bosses for IT staff during projects.

Organizations should be project-centered, not job function-centered.
-Allows for team members to assume different roles in each project

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Departmental Attributes: Innovative

A
  • Reward systems that encourage new ideas and successful implementation of innovative applications
  • Create dedicated research and development groups.
  • Permit IT staff to take sabbaticals or work in other departments within the organization to expand their awareness of organizational operations, cultures, and issues.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Outsourced IT

A

An organization asks a third party to provide IT staff members and be responsible for the management of IT.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Reasons for Outsourcing

A
  • Organizations may not have in-house staff with the skills, time or resources to take on new projects or provide sufficient support
  • Organizations may delegate help desk services or website development so that internal staff can focus on implementing and supporting applications.
  • May be cost-controlling
  • May serve as a solution to mismanaged IT staff
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Evaluating IT Effectiveness: Governance

A

Are IT strategies aligned with the overall strategic goals?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Evaluating IT Effectiveness: Budget Development and Resource Allocation

A

Benchmark: Are we spending too much or too little on IT?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Evaluating IT Effectiveness: System Acquisition and Implementation

A

How effective are the system’s acquired?

Are new applications delivered on time, within budget, and according to specifications?

How do participants in the implementation view the IT staff?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Evaluating IT Effectiveness: IT Service Levels

A

What is the quality of everyday IT service?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

IT Service Levels: Infrastructure

A

Are the information systems reliable?

Are response times fast?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

IT Service Levels: Day-to-Day Support

A

Does the help desk quickly, patiently, and effectively resolve my problems?

Do technological requests get answered in a reasonable time frame?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

IT Service Levels: Consultation

A

Does the IT staff help me think through my IT needs?

Is IT capable of making people understand what technology will and will not do for them?

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Evaluating IT Effectiveness: Infrastructure Metrics

A

Benchmarks for the quality of IT infrastructure and day-to-day support.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Infrastructure Metrics: Reliability

A

Percentage of time that systems experience downtime

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Infrastructure Metrics: Response Time

A

How quickly an application moves from one screen tot he next.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Infrastructure Metrics: Resiliency

A

How quickly a system can recover once it has gone down.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Infrastructure Metrics: Software bugs

A

The number of bugs detected in an application per line or per hour of use.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Core IT Processes for Effective IT Department: Human Capital Management

A

The development of IT staff skills and the attraction/retention of talent

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Core IT Processes for Effective IT Department: Platform Management

A

A series of activities that designs the IT architecture and constructs and manages the resulting infrastructure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Core IT Processes for Effective IT Department: Relationship Management

A

Developing and maintaining relations between the IT function and the rest of the organization

Also, partnerships with IT vendors.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Core IT Processes for Effective IT Department: Strategic Planning

A

Linking the IT agenda to the organization’s strategy

41
Q

Core IT Processes for Effective IT Department: Financial Management

A

Encompasses a wide range of management processes, such as:

  • Developing the IT budget
  • Defining the business case for IT investments
  • Benchmarking IT costs
42
Q

Core IT Processes for Effective IT Department: Value Innovation

A

Identifying new ways for IT to improve business operations and ensuring that IT investments deliver value

43
Q

Core IT Processes for Effective IT Department: Solutions Delivery

A

The selection, development, and implementation of applications and infrastructure

44
Q

Core IT Processes for Effective IT Department: Services Provisioning

A

Day-to-day support of applications and infrastructure.

45
Q

Privacy

A

An individual’s right to be be left alone and limit access to his/her health information.

46
Q

Confidentiality

A

Addresses the expectation that information shared with a health care provider during the course of treatment will be used only for its intended purpose and not disclosed otherwise.

47
Q

Security

A

The systems in place to protect health information and the systems within which it resides.

48
Q

Legal Protection of Health Information

A
  • Federal HIPAA privacy, Security, and Breach Notification rules.
  • State privacy laws. Usually more stringent on info for conditions such as HIV/AIDS, mental & reproductive health.
  • Federal Trade Commission (FTC) Act: Protects consumers from unfair or deceptive practices.
  • The Privacy Act of 1974
  • Confidentiality and Substance Abuse Patient Records
49
Q

The Privacy Act of 1974

A

Protected patient confidentiality only in federally operated health care facilities.

50
Q

Confidentiality and Substance Abuse Patient Records

A

Set stringent release of information standards, designed to protect confidentiality of patients seeking alcohol or drug treatment.

51
Q

HIPAA Timeline

A

1996: Signed into law [First comprehensive federal regulation to offer special protection to private health information.]
2003: HIPAA Privacy Rule
2005: HIPAA Security Rule. [Defines Covered Entities(CE)]

52
Q

HIPAA Privacy Rule: Protected Health Information defined

A
  • Relates to a person’s physical/mental health, the provision of care, or the payment for care.
  • Identifies the person who is the subject of the information.
  • Is created or received by a CE
  • Is transmitted or maintained in any form.
53
Q

HIPAA Privacy Rule Major Components: Boundaries

A

PHI may be disclosed for health purposes only, with very limited exceptions.

54
Q

HIPAA Privacy Rule Major Components: Security

A

PHI should not be distributed without patient authorization unless there is a clear basis for doing so and the individuals who receive the information must safeguard it.

55
Q

HIPAA Privacy Rule Major Components: Consumer Control

A

Individuals are entitled to access and control their health records and are to be informed of the purposes for which information is being disclosed and used.

56
Q

HIPAA Privacy Rule Major Components: Accountability

A

Entities that improperly handles PHI can be charged under criminal law and punished and are subject to civil recourse as well.

57
Q

HIPAA Privacy Rule Major Components: Public Responsibility

A

Individual interests must not override national priorities in public health, medical research, preventing health care fraud, and law enforcement in general.

58
Q

HIPAA Patient Authorization: Defined

A

Written authorization required for all nonroutine uses of diclosure of PHI.

59
Q

HIPAA Patient Authorization: Exceptions

A

PHI can be released without consent in the following instances:

  • Presence of a communicable disease
  • Suspected child or adult abuse
  • Legal duty to warn of a clear and imminent danger from a patient.
  • Bona fide medical emergency
  • Valid court order
60
Q

HIPAA Patient Authorization: Elements of a Valid Release Form

A

1) Patient identification (Name, DOB)
2) Name of person/entity to whom the information is being released
3) Description of specific health information authorized for disclosure.
4) Statement of reason/purpose of disclosure.
5) Date, event, or condition for expiration of authorization, unless revoked sooner.
6) Statement that authorization is subject to revocation by patient/legal representative.
7) Patient/Legal rep’s signature
8) Signature date

61
Q

HIPAA Security Rule: Defined

A

Governs ePHI

  • PHI maintained or transmitted in electronic form
  • May be stored on any type of electronic media
62
Q

HIPAA Security Administrative Safeguards: Security Management functions

A

CE must implement policies and procedures to prevent, detect, contain, and correct security violations.

63
Q

HIPAA Security Administrative Safeguards: Assigned Security Responsibility

A

CE must identify the individual responsible for overseeing development of the organization’s security policies and procedures.

64
Q

HIPAA Security Administrative Safeguards: Workforce Security

A

CE must ensure that all members of its workforce have appropriate access to ePHI.

65
Q

HIPAA Security Administrative Safeguards: Information Access Management

A

CE must implement policies and procedures for authorizing access to ePHI.

66
Q

HIPAA Security Administrative Safeguards: Security Awareness and Training

A

CE must install awareness/training programs for all members of its workforce.

67
Q

HIPAA Security Administrative Safeguards: Security Incident Reporting

A

CE must implement policies and procedures for addressing security incidents.

68
Q

HIPAA Security Administrative Safeguards: Contigency Plan

A

Procedures for disaster recovery.

69
Q

HIPAA Security Administrative Safeguards: Evaluation

A

CE must periodically perform technical and nontechnical evaluations in response to changes that may affect ePHI security.

70
Q

HIPAA Security Administrative Safeguards: Business Associate Contracts and other arrangements

A

CE must have formal agreement with business associates in order to exchange ePHI.

71
Q

HIPPA Security Physical Safeguards: Facility Access Controls

A

CE must limit physical access to its electronic information systems, and the facilities in which they are housed, to authorized users.

72
Q

HIPPA Security Physical Safeguards: Workstation Use

A

CE must specify the functions to be performed and the manner in which they are to be performed on a specific workstation or class of workstation that can be used to access ePHI and that also specify the physical attributes of the surroundings of such workstations.

73
Q

HIPPA Security Physical Safeguards: Workstation Security

A

CE must arrange the physical safeguards for all workstations that are used for ePHI access and limit access to authorized users.

74
Q

HIPPA Security Physical Safeguards: Device and Media Control

A

CE must arrange for the movement of hardware and electronic media that contain ePHI into and out of a facility and within a facility.

75
Q

HIPPA Security Technical Safeguards: Access Control

A

CE must establish who may or may not be able to utilize ePHI

76
Q

HIPPA Security Technical Safeguards: Audit Controls

A

CE must implement hardware, software, and procedures that record and examine activity in the information systems containing ePHI.

77
Q

HIPPA Security Technical Safeguards: Integrity

A

CE must protect ePHI from improper alteration or destruction

78
Q

HIPPA Security Technical Safeguards: Person or Entity Authentication

A

CE must require verification process for those attempting access of ePHI

79
Q

HIPPA Security Technical Safeguards: Transmission Security

A

CE must implement technical measures to guard against unauthorized access to ePHI.

80
Q

HIPAA Policies and Procedures

A

CE must establish protocol to comply with standards. implementation specifications and other requirements.

81
Q

HIPAA Documentation

A

CE must establish policies that comply with the Security Rule in written form.

82
Q

HIPAA Breach Notification Rule

A

Requires CE’s and their business associates to provide notification following a breach of UNSECURED PHI.

  • Unsecured: Info that has not been encrypted
  • Secured: Encrypted data or data that has been deemed, “Destroyed”
83
Q

HIPAA Breach Notification Rule: WHO?

A
  • Affected individuals
  • Health and Human Services (via Office for Civil Rights)
  • Major media outlets
84
Q

HIPAA Enforcement

A
  • Office for Civil Rights (OCR) enforces Privacy and Security rules
  • State Attorney Generals were given authority by HITECH to bring civil actions on behalf of the residents of their state when involved in a HIPAA violation.
85
Q

HIPAA Violation Penalties

A
  • Tiered criminal penalties:
    • I: Reasonable cause or no knowledge (~1yr)
    • II: Obtaining PHI under false pretenses (1-5yr)
    • III: Obtaining PHI for personal gain or malice (1-10yr)

-Monetary Civil penalties which cannot be levied if resolved within a specific period of time.

86
Q

Threats to HIPAA

A
  • Human tampering (intentional/unintentional; Internal/External)
  • Natural or environmental
  • Environmental factors and technological malfunction
87
Q

Malware

A

Software that is written to “infect” and subsequently harm a host computer systems

88
Q

Viruses

A

Infects the host system and spread itself

89
Q

Trojans

A

Designed to look like a safe program; steals personal information or takes over the resources of a host computer.

90
Q

Spyware

A

Tracks Internet activities, assisting the hacker in gathering information without consent

91
Q

Worms

A

Replicates itself and destroys the host computer’s files

92
Q

Ransomware

A

Encrypts and locks files; demands money to unlock

93
Q

Security Management Process

A

1) Lead your culture, select your team, and learn.
2) Document your process, findings, and actions
3) Review existing security of ePHI; perform risk analysis
4) Develop an action plan
5) Manage and mitigate risks
6) Attest for meaningful use security-related objectives
7) Monitor, audit, and update security on an ongoing basis

94
Q

Cybersecurity

A

1) Protect mobile devices
2) Maintain good computer habits
3) Use a firewall
4) Install and maintain antivirus software
5) Plan for the unexpected
6) Control access to PHI
7) Use strong passwords
8) Limit network access
9) Control physical access

95
Q

National Institute of Standards and Technology (NIST)

A

Directed to develop, with the help of stakeholder organizations, a voluntary cybersecurity framework to reduce cyber-attack risks.

96
Q

NIST: Framework Core

A

Five concurrent and continuous functions:

1) Identify
2) Protect
3) Detect
4) Respond
5) Recover

-The highest level, strategic view of an organization’s management of cybersecurity risks

97
Q

NIST: Framework Implementation Tiers

A

Characterizes an organization’s actual cybersecurity practices compared to the framework; range from Tier 1 (Partial) to Tier 4 (Adaptive).

98
Q

NIST: Framework Profile

A

Documents outcomes obtained by reviewing all of the categories and subcategories and comparing them to the organization’s business needs

HCISSP ISC2 (56 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions