Which of the following laws applies to organizations handling health care information?

• A.GLBA
• B.HIPAA
• C.SOX
• D.FISMA

Correct Answer: B

Explanation/Reference:
Explanation:
HIPAA handles health care information of an organization.
The Health Insurance Portability and Accountability Act (HIPAA) were introduced in 1996. It ensures that health information data is protected. Before HIPAA, personal medical information was often available to anyone. Security to protect the data was lax, and the data was often misused.
If your organization handles health information, HIPAA applies. HIPAA defines health information as any data that is created or received by health care providers, health plans, public health authorities, employers, life insurers, schools or universities, and health care clearinghouses.
HIPAA defines any data that is related to the health of an individual, including past/present/future health, physical/mental health, and past/present/future payments for health care.
Creating a HIPAA compliance plan involves following phases:
Assessment: An assessment helps in identifying whether organization is covered by HIPAA. If it is, then

further requirement is to identify what data is needed to protect.
Risk analysis: A risk analysis helps to identify the risks. In this phase, analyzing method of handling

data of organization is done.
Plan creation: After identifying the risks, plan is created. This plan includes methods to reduce the risk.

Plan implementation: In this plan is being implemented.

Continuous monitoring: Security in depth requires continuous monitoring. Monitor regulations for

changes. Monitor risks for changes. Monitor the plan to ensure it is still used.
Assessment: Regular reviews are conducted to ensure that the organization remains in compliance.

Incorrect Answers:
A: GLBA is not used for handling health care information.
C: SOX designed to hold executives and board members personally responsible for financial data.
D: FISMA ensures protection of data of federal agencies.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GRT project. You discovered that by bringing on more qualified resources or by providing even better quality than originally planned, could result in reducing the amount of time required to complete the project. If your organization seizes this opportunity it would be an example of what risk response?

• A.Enhance
• B.Exploit
• C.Accept
• D.Share
• E.Explanation:
  Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities forpositive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.

Comment: *

Name: *

Email: *

Verification: *

You are the risk control professional of your enterprise. You have implemented a tool that correlates information from multiple sources. To which of the following do this monitoring tool focuses?

• A.Transaction data
• B.Process integrity
• C.Configuration settings
• D.System changes

Comment: *

Name: *

Email: *

Verification: *

You have been assigned as the Project Manager for a new project that involves development of a new interface for your existing time management system. You have completed identifying all possible risks along with the stakeholders and team and have calculated the probability and impact of these risks. Which of the following would you need next to help you prioritize the risks?

• A.Affinity Diagram
• B.Risk rating rules
• C.Project Network Diagram
• D.Risk categories

Comment: *

Name: *

Email: *

Verification: *

Which of the following is the BEST indication that key risk indicators (KRls) should be revised?

• A.A decrease In the number of key performance indicators (KPls)
• B.An increase in the number of change events pending management review
• C.A decrease in the number of critical assets covered by risk thresholds
• D.An Increase In the number of risk threshold exceptions

Comment: *

Name: *

Email: *

Verification: *