Healthcare Data Breach Response Flashcards

Which of the following events would NOT qualify as a 'breach' under the HIPAA Breach Notification Rule?

Answer: A workforce member accesses a patient's record for treatment purposes under a valid TPO purpose

Accessing PHI for legitimate treatment, payment, or operations purposes is not an impermissible use and therefore does not constitute a breach under HIPAA.

When a business associate discovers a breach of PHI, within what timeframe must it notify the covered entity?

Answer: Without unreasonable delay and within 60 days of discovery

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days following discovery.

Under HIPAA, which of the following PHI disposal methods is considered a safe harbor that renders a breach not reportable?

Answer: Proper destruction (shredding, degaussing) rendering PHI unreadable or indecipherable

PHI that has been rendered unreadable, indecipherable, or destroyed through proper methods (shredding paper, degaussing/purging media) is excluded from breach notification requirements.

A covered entity discovers that a workforce member has been snooping on celebrity patient records over the past year. How many breaches does this represent?

Answer: One breach per patient record impermissibly accessed

Each patient's record that was impermissibly accessed represents a separate potential breach requiring individual analysis under the four-factor risk assessment.

Under HIPAA, breach discovery is defined as the date on which which party first knows or reasonably should have known of the breach?

Answer: The covered entity or business associate, whichever is the data holder

Discovery date is when the covered entity or business associate (whichever holds the data) first knew or should have known about the breach through reasonable diligence.

What type of PHI is specifically excluded from the HIPAA Breach Notification Rule's definition of PHI for breach purposes?

Answer: PHI in a Limited Data Set

Limited Data Sets (which remove direct identifiers but retain some indirect identifiers like dates and geographic data) are excluded from the Breach Notification Rule's definition of PHI for breach purposes when covered by a DUA.