Breach Notification & Legal Enforcement Flashcards
7 cards from real CHP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Breach Notification & Legal Enforcement flashcards as text
A covered entity's compliance officer suspects a breach but delays investigation for 3 months. During investigation, the 60-day window is measured from which point?
Answer: The date the compliance officer first suspected the breach
The 60-day clock starts from the date of discovery, which is when the covered entity first knew or reasonably should have known of the breach — not when investigation concludes.
Which of the following PHI disclosure scenarios qualifies for the 'limited data set' exception and is NOT treated as a breach?
Answer: Disclosing a limited data set under a data use agreement for research
Disclosure of a limited data set (with direct identifiers removed) under a proper data use agreement (DUA) is a permitted HIPAA disclosure and does not constitute a breach.
What is the primary purpose of the HITECH Act's breach notification provisions that were later incorporated into HIPAA?
Answer: To strengthen enforcement and extend HIPAA obligations to business associates
The HITECH Act significantly strengthened HIPAA enforcement, expanded obligations to business associates, and introduced breach notification requirements that were later codified in the HIPAA rules.
An OCR audit reveals a pattern of non-compliance at a covered entity. OCR issues a Resolution Agreement. What does this typically require?
Answer: Payment of a settlement amount and implementation of a corrective action plan
Resolution Agreements resolve OCR investigations through a negotiated settlement payment and a corrective action plan to address systemic compliance deficiencies.
A small rural clinic experiences a breach affecting 12 individuals. The clinic cannot afford to send individual letters. What is NOT an acceptable substitute notification method under HIPAA?
Answer: Sending a mass text message to all clinic patients
HIPAA's substitute notice options include website posting, major print/broadcast media, and a toll-free phone number — mass text messaging is not a recognized substitute method.
Which violation tier carries the lowest minimum civil monetary penalty per violation under HIPAA?
Answer: No knowledge
The 'no knowledge' tier carries the lowest minimum penalty of $100 per violation, reflecting that the covered entity did not know and could not have reasonably known of the violation.
A covered entity's breach notification to affected individuals must be written in what manner to comply with HIPAA?
Answer: In plain language that is understandable to the affected individuals
HIPAA requires breach notifications to be written in plain language so that affected individuals can understand what happened and what they should do.