Healthcare Data Breach Response Flashcards

Which of the following organizations maintains the 'Wall of Shame' — the public list of healthcare breaches affecting 500 or more individuals?

Answer: HHS Office for Civil Rights (OCR)

OCR maintains the public breach portal (colloquially called the 'Wall of Shame') listing breaches affecting 500 or more individuals as required by HITECH.

A hospital's backup tapes containing unencrypted ePHI are discovered missing after a vendor picks them up for off-site storage. Under HIPAA, the hospital should FIRST:

Answer: Conduct a risk assessment to determine the probability that PHI was compromised

Before triggering breach notification, the covered entity must conduct the four-factor risk assessment to determine whether there is a low probability of PHI compromise.

Under HIPAA, which of the following is an acceptable substitute for individual breach notification when the covered entity has insufficient contact information?

Answer: Posting conspicuous notice on the covered entity's website for 90 days and notifying major print/broadcast media

When direct contact information is unavailable, substitute notice may be provided by posting on the covered entity's website for 90 days or in major print or broadcast media serving the affected area.

What is the maximum civil monetary penalty under HIPAA for violations due to willful neglect that are not corrected?

Answer: $50,000 per violation up to $1.5 million per year

Willful neglect violations not corrected carry penalties of $50,000 per violation up to a maximum of $1.5 million per calendar year for identical violations.

Under HIPAA, which term describes a vendor that provides services to a covered entity and creates, receives, maintains, or transmits PHI in the course of providing those services?

Answer: Business Associate

A business associate is a person or entity that performs services for a covered entity involving the use or disclosure of PHI, and must sign a Business Associate Agreement.

Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?

Answer: HHS Office for Civil Rights (OCR)

The HHS Office for Civil Rights (OCR) is the primary federal agency responsible for enforcing the HIPAA Privacy, Security, and Breach Notification Rules.