Breach Notification & Legal Enforcement Flashcards
7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Breach Notification & Legal Enforcement flashcards as text
Which federal agency handles criminal prosecution of knowing HIPAA violations?
Answer: Department of Justice
The Department of Justice (DOJ) is responsible for prosecuting knowing violations of HIPAA that rise to the level of criminal conduct.
A breach affects 600 patients at a hospital. In addition to notifying individuals and HHS, what additional step is required?
Answer: Provide notice to prominent media outlets in the affected area
Breaches affecting 500 or more individuals in a state or jurisdiction require notice to prominent media outlets serving that area.
Under HIPAA, what is the annual cap on civil monetary penalties for identical violations within the same calendar year?
Answer: $1,500,000
The annual cap for civil monetary penalties for violations of the same provision is $1,500,000 per calendar year.
A covered entity discovers a breach on March 1. The 60-day notification clock begins on which date?
Answer: The date the breach was discovered
The 60-day notification period runs from the date of discovery of the breach, not the date the breach occurred.
Which of the following is NOT one of the four factors in the HIPAA breach risk assessment?
Answer: The financial net worth of the covered entity
The four-factor risk assessment does not include the financial status of the covered entity; it focuses on the nature of the PHI, the recipient, acquisition/viewing, and mitigation.
An individual files a HIPAA complaint with OCR against a covered entity. OCR investigates and finds no violation. What is the most likely outcome?
Answer: OCR closes the case with a finding of no violation
When OCR finds no violation after investigation, it closes the case and notifies both the complainant and the covered entity.
A business associate experiences a breach of PHI it holds on behalf of a covered entity. Under the HIPAA Breach Notification Rule, when must the business associate notify the covered entity?
Answer: Without unreasonable delay and no later than 60 days from discovery
Business associates must notify the covered entity without unreasonable delay and within 60 calendar days of discovering the breach.