Healthcare Data Breach Response Flashcards

Under the HIPAA Breach Notification Rule, what is the presumption when an impermissible use or disclosure of PHI occurs?

Answer: The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise

Under the 2013 Omnibus Rule, an impermissible use or disclosure is presumed to be a breach unless a covered entity can demonstrate through a four-factor risk assessment that there is a low probability the PHI was compromised.

The four-factor risk assessment under the HIPAA Breach Notification Rule includes all of the following EXCEPT:

Answer: Whether the affected individual has experienced actual identity theft

Actual identity theft is not one of the four factors — the assessment focuses on probability of compromise, not actual harm after the fact.

When must a covered entity notify the Secretary of HHS of a breach affecting fewer than 500 individuals in a single state?

Answer: Within 60 days of the end of the calendar year in which the breach was discovered

Small breaches (fewer than 500 individuals) must be logged and reported to HHS annually no later than 60 days after the end of the calendar year in which they were discovered.

A hospital discovers a breach on March 15. Under HIPAA, individual breach notifications must be sent no later than:

Answer: May 14 (60 days after discovery)

Individual notifications must be provided without unreasonable delay and no later than 60 days following discovery of the breach.

When a breach affects 500 or more residents of a state or jurisdiction, a covered entity must notify which additional party?

Answer: Prominent media outlets serving the state or jurisdiction

When a breach affects 500 or more residents of a state, the covered entity must provide notice to prominent media outlets in addition to individual and HHS notification.

Under the HIPAA Breach Notification Rule, which of the following is NOT a required element of individual breach notification?

Answer: A description of the covered entity's security vulnerabilities that caused the breach

While entities must provide breach details and mitigation guidance, disclosing the specific internal security vulnerabilities that caused the breach is not a required element of individual notification.