8/21/25, 12:32 AM Georgia Access 2025
GEORGIA CNA EXAM PREP –HIPAA&PHI COMPLIANCE
PRACTICE TEST BANK EXAM 2025-2026 \LATEST UPADTE
Which of the following is not The requirement that is not applicable for handling
a requirement for handling Personally Identifiable Information (PII) and Protected
Personally Identifiable Health Information (PHI) is:
Information (PII) and Store all consumer PII and PHI on a backup device
While it is important to ensure the security and
Protected Health
confidentiality of PII and PHI, storing data on a backup
Information (PHI)?
device is not a specific requirement. The focus
All information received must should be on
be kept ensuring confidentiality, collecting only necessary
confidential in accordance information, and sharing it only with authorized
with applicable state and individuals.
federal laws and
regulations
Only information required to
assist the
consumer can be
gathered/collected Store all
consumer PII and PHI on a
backup device
Only share consumer PII
and PHI with those who are
authorized to receive such
information
If you suspect or witness a If you suspect or witness a breach involving unsecured
breach involving unsecured Personally Identifiable Information (PII), the first thing
Personally Identifiable you should do is:
Information (PII), what is the Report the incident immediately to Georgia Access and no later
than twenty-four
first thing you should do? (24) hours after discovery of the incident.
Nothing
Alert the media
Call the consumer who's PII
/ 1/25
,8/21/25, 12:32 AM Georgia Access 2025
was compromised to let
them know
Report the incident
immediately to Georgia
Access and no later than
twenty-four (24)
hours, after discovery of the
incident
/ 2/25
, 8/21/25, 12:32 AM Georgia Access 2025
Fill in the blank: When When violations result in monetary fines from the state
violations result in or federal government, the fines associated with the
monetary fines from the violation are considered Civil penalties.
state or federal
government, the fines
associated with the
violation are considered
_______________ _.
Civil penalties
Criminal
penalties
Federal
penalties
Negligible
Fill in the blank: A(n) is A(n) Breach is the acquisition, access, use, or disclosure of
the acquisition, Protected Health
access, use, or disclosure Information (PHI) in a manner not permitted and that
of Protected Health compromises the security or privacy of the PHI.
Information (PHI) in a
manner not permitted and
that compromises the
security or privacy of the
PHI.
Computer
Threat
Breach
Security
Incident
Access
Control
/ 3/25
GEORGIA CNA EXAM PREP –HIPAA&PHI COMPLIANCE
PRACTICE TEST BANK EXAM 2025-2026 \LATEST UPADTE
Which of the following is not The requirement that is not applicable for handling
a requirement for handling Personally Identifiable Information (PII) and Protected
Personally Identifiable Health Information (PHI) is:
Information (PII) and Store all consumer PII and PHI on a backup device
While it is important to ensure the security and
Protected Health
confidentiality of PII and PHI, storing data on a backup
Information (PHI)?
device is not a specific requirement. The focus
All information received must should be on
be kept ensuring confidentiality, collecting only necessary
confidential in accordance information, and sharing it only with authorized
with applicable state and individuals.
federal laws and
regulations
Only information required to
assist the
consumer can be
gathered/collected Store all
consumer PII and PHI on a
backup device
Only share consumer PII
and PHI with those who are
authorized to receive such
information
If you suspect or witness a If you suspect or witness a breach involving unsecured
breach involving unsecured Personally Identifiable Information (PII), the first thing
Personally Identifiable you should do is:
Information (PII), what is the Report the incident immediately to Georgia Access and no later
than twenty-four
first thing you should do? (24) hours after discovery of the incident.
Nothing
Alert the media
Call the consumer who's PII
/ 1/25
,8/21/25, 12:32 AM Georgia Access 2025
was compromised to let
them know
Report the incident
immediately to Georgia
Access and no later than
twenty-four (24)
hours, after discovery of the
incident
/ 2/25
, 8/21/25, 12:32 AM Georgia Access 2025
Fill in the blank: When When violations result in monetary fines from the state
violations result in or federal government, the fines associated with the
monetary fines from the violation are considered Civil penalties.
state or federal
government, the fines
associated with the
violation are considered
_______________ _.
Civil penalties
Criminal
penalties
Federal
penalties
Negligible
Fill in the blank: A(n) is A(n) Breach is the acquisition, access, use, or disclosure of
the acquisition, Protected Health
access, use, or disclosure Information (PHI) in a manner not permitted and that
of Protected Health compromises the security or privacy of the PHI.
Information (PHI) in a
manner not permitted and
that compromises the
security or privacy of the
PHI.
Computer
Threat
Breach
Security
Incident
Access
Control
/ 3/25
