CHP Breach Notification & Legal Enforcement 2

Question 1

A covered entity discovers that a business associate improperly disclosed PHI for 520 individuals. Who must notify the affected individuals?

Accepted Answer

The covered entity

Answer

The covered entity retains responsibility for notifying affected individuals even when the breach is caused by a business associate.

Question 2

Under HIPAA, what is the maximum penalty tier for violations due to willful neglect that are not corrected within the required timeframe?

Accepted Answer

$50,000 per violation

Answer

Willful neglect not corrected carries a minimum of $10,000 and maximum of $50,000 per identical violation category per year.

Question 3

A hospital's laptop containing unencrypted PHI is stolen. The hospital determines 480 individuals are affected. What is the correct breach notification sequence?

Accepted Answer

Notify individuals within 60 days and HHS within 60 days

Answer

For breaches affecting fewer than 500 individuals, covered entities must notify individuals and HHS within 60 days of discovery.

Question 4

Which of the following constitutes a 'breach' under the HIPAA Breach Notification Rule?

Accepted Answer

Impermissible use or disclosure of PHI that compromises its security or privacy

Answer

A breach is defined as an impermissible use or disclosure of PHI that poses a significant risk of financial, reputational, or other harm to the individual.

Question 5

A covered entity believes a breach occurred but cannot demonstrate a low probability that PHI was compromised. Under HIPAA, what must it do?

Accepted Answer

Treat the incident as a breach and provide required notifications

Answer

If the covered entity cannot demonstrate a low probability of compromise using the four-factor risk assessment, it must treat the event as a breach and notify.

(CHP) Certified HIPAA Professional Practice Test

(CHP) Certified HIPAA Professional Practice Test

CHP Breach Notification & Legal Enforcement 2