GoConqr hat ein neues Design! Sag uns, wie es dir gefällt.

Kostenlos registrieren

Karteikarten

SecurityAmia22

Michael Riben HealthInformationSystems Board Exam Englisch 41 Karten

Karten in diesem Stapel (41)

  1. 1what is a firewall?set of hardware components and network with software to restrict network traffic to conform to security policy of the site
  2. 2what is a virtual private network?virtual network built on top of physical networks, that provide a secure communications mechanism for data and other information transmitted between networks
  3. 3define encryptionthe method of converting an original message/data into "encoded" data by means of an algorithm. which requires a "key" that only the receiver should have and be able to decrypt the data
  4. 4List some data encryption standaredsDES = data encryption standard
    Triple DES, AES = advanced encryption standard
  5. 5What is a hash?method of cryptography that converts any data into a unique string of text. any piece of data can be hashed, no matter type or size
  6. 6Give examples of Hash Algorithms?SHA-1, SHA256, Message-digest 5 (MD-5), Hash message authentication code (HMAC)
  7. 7What is public-key encryptiona cryptographic system that uses keys where public keys ( known by others) and private keys (only known by onwer)
  8. 8what is a zero-day vulnerability?newly discovered, and it is newly discovered and no update to fix issue has been released yet.
  9. 9What are provisions of the hipaa security rule?1)ensure confidentiality , integrity and availability of all e-PHI that they create, maintain, receive or transmit 2) identify and protect against reasonably anticipated threats to security or integrity 3) protect against reasonably anticipated impermissible uses or disclosures, 4) ensure compliance by workforce
  10. 10how does hipaa define Confidentiality ?e-phi is not available or disclosed to unauthorized persons. supports the privacy rule prohibitions against improper use and disclosure - promotes 2 additional goals --> integrity and availability
  11. 11Under HIPAA security rule, what does integrity mean?e-Phi is not altered or destroyed in an unauthorized manner
  12. 12Under hipaa security rule, what does availability mean?e-PHI is accessible to authorized users on demand
  13. 13How did security and privacy part of ARRA change HIPPA1) limited data sets 2) restrictions on disclosures, and 3) added reporting requirements
    and made sure that enforcement included both CIVIL and CRIMINAL penalties
  14. 14What big change did ARRA make to HIPAA privacy and securityApplied to Business associates requiring changes to agreements, BAA must demonstrate documented policies and procedures, and notify covered entities and HHS of breaches
  15. 15who is covered under hipaa?Providers of all types, Health plans of all types, clearinghouses that process transactions
  16. 16what does HIPAA stand for?Health Insurance Portability and Accountability ACt
  17. 17define a business associateperson/entity other than a workforce member who performs functions or activities on your behalf, provides certain services to or for you, and when services involve the access to, or the use of , or disclosure of PHI
  18. 18what is considered a breach?unauthorized acquisition, access, or disclosure of unsecured PHI which compromises the privacy, security or integrity of PHI
    Unsecured = Phi not secured by technology or method specified by hhs through guidance
  19. 19What are the reporting requirements for a breach1) notify individuals w/in 60 days
    2) notify public media if >500 pts
    3) notify HHS without delay for breaches >500
    4) annual report to secretary of all breaches
  20. 20List technical measures to prevent breaches?audit trails, encryption, VPN, software discipline, system assessments, strong authentication, firewalls
  21. 21What is Authentication?process of verifying the identity of an entity that is source of a request, or response for information in a computing environment
  22. 22what are the possible criteria that authentication is based on?1) something you have - key, card, token
    2) something you know (mothers maiden name)
    3) something related to you - fingerprint, retina, voiceprint, dna
    4) something indicating location - termina id, network address
  23. 23what is difference btw authentication and authorization?Authentication ---> who you are
    Authorization --> what you can do
  24. 24how are "ease of access" and "security controls related?They work against each other
  25. 25what is Blockchain?hashchain of block used to create a distributed ledger in conjunction with a consensus protocol and membership protocol
  26. 26what are the benefits of blockchain?decentralized management, immutable audit trail, data provenance, robustness and availability and security/privacy
  27. 27Name three types of security controls?Administrative
    Physical
    Technical
  28. 28give examples of administrative security controls?internet use policy, password management policy, not using SSN in clinical research , BAAs , contracts
  29. 29Give examples of physical security controls?badge access, camera/rfid protection, dual lock systems for pathogens/animal, data center and data closet security
  30. 30give examples of technical security controlsfirewalls, VPNs, Network Access controls, Intrusion Detection and preventions systems (IDPS) , data leakage protection, encryption, authentication, authorization, audit logs, patching, antivirus/spyware, host based firewalls, etc
  31. 31list best practice for organizations for security?security/confidentiality policies
    Security/confidentiality committees
    Information Security Officer
    Education/Training
    Sanctions
    Improved authorization forms
    Patient Access and audit logs
  32. 32what examples of security layers in a healthcare orgPhysical -fire/power/intrusion
    NEtwork - firewalls, wired equiv.privacy)
    Social -phishing, malware, spoofing
    Software - design, updates, authentication
    Data - backup, restore, redundancy
  33. 33what is malwaremalicious software
  34. 34what is a "spoofing" attack?person/program successfully masquerades as another by falsifying data , illegitimate advantage
  35. 35what is "phishing"deception using email where users are enticed to follow attackers instructions to go to malicious sites or impersonate valid sites to steal data/credentials
  36. 36what is a Denial of Service Attackattempts to prevent legitimate user access to information systems
  37. 37what is ransomeware?malware that infects a system/network and prevents users from accessing the computers without paying the ransom. wont restore if not paid
  38. 38what is the # 1 cause of security threat to healthcare ?Improper usage by inside individuals
  39. 39what law requires healthcare orgs to conduct/review security risk analysis and implement security updates as necessaryARRA 45 CFR 164.308 a(1)
  40. 40who is the enforcer of the security breach incidents?The office of Civil Rights (OCR)
  41. 41What is DMARC?domain -based message authentication , reporting, and conformance - = email authentication, policy, and reporting protocol - built on SPF and DKIM

Informationen

Beschreibung
Board Exam HealthInformationSystems Karteikarten am SecurityAmia22, erstellt von Michael Riben am 06/10/2022.
Erstellt von
Michael Riben
Aufrufe
1
Bewertung

Feedback

Worum geht es?

Wie gefällt dir das neue Design?

Dein Eindruck