CHISSP CHISSP HIPAA Compliance & Healthcare Data Privacy 2

Question 1

Under the HIPAA Breach Notification Rule, what is the deadline for notifying affected individuals after discovery of a breach affecting fewer than 500 patients?

Accepted Answer

Within 60 days of end of the calendar year in which the breach was discovered

Answer

For breaches affecting fewer than 500 individuals, covered entities must notify affected patients within 60 days of the end of the calendar year, though prompt notification is encouraged.

Question 2

A ransomware attack encrypts ePHI on a hospital's servers. Under HIPAA Breach Notification Rule guidance, how should this be treated?

Accepted Answer

Presumed a reportable breach unless the entity can demonstrate low probability of PHI compromise

Answer

HHS OCR guidance states ransomware attacks presumptively constitute breaches because unauthorized access occurred; the covered entity must conduct a four-factor risk assessment to rebut this presumption.

Question 3

Which federal agency is primarily responsible for enforcing HIPAA Privacy and Security Rules?

Accepted Answer

HHS Office for Civil Rights (OCR)

Answer

HHS OCR is the primary HIPAA enforcement agency, investigating complaints, conducting audits, and imposing civil monetary penalties for Privacy and Security Rule violations.

Question 4

What is a 'Notice of Privacy Practices' (NPP) under HIPAA, and when must it be provided to patients?

Accepted Answer

A document describing how PHI is used and disclosed, provided at first service delivery

Answer

The NPP is required by HIPAA §164.520 and must be provided no later than the first date of service, informing patients of their rights and the covered entity's privacy practices.

Question 5

Under HITECH's breach notification provisions, what threshold triggers the requirement for media notification in addition to individual notification?

Accepted Answer

Breaches affecting 500 or more residents of a state or jurisdiction

Answer

When a breach affects 500 or more residents of a state or jurisdiction, HIPAA requires prominent media notification (e.g., press release) in addition to individual and HHS notification.

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP - Certified Healthcare Information Systems Security Practitioner Practice Test

CHISSP CHISSP HIPAA Compliance & Healthcare Data Privacy 2