CHP Documentation & Record Keeping 5

Question 1

Under the HIPAA Breach Notification Rule, how long must documentation of a breach investigation and notification be retained?

Accepted Answer

6 years

Answer

Breach notification documentation, including the investigation, risk assessment, and notification records, must be retained for 6 years per HIPAA's standard documentation retention requirement.

Question 2

What must a covered entity document when determining that a breach does NOT require notification?

Accepted Answer

The low probability risk assessment demonstrating that the four-factor analysis supports an exception

Answer

When a covered entity concludes a breach does not require notification because there is a low probability that PHI was compromised, it must document the four-factor risk assessment analysis supporting that conclusion.

Question 3

A covered entity discovers a breach on March 1. By what date must it notify the Secretary of HHS if fewer than 500 individuals were affected?

Accepted Answer

Within 60 days after the end of the calendar year in which the breach was discovered

Answer

For breaches affecting fewer than 500 individuals, covered entities must report to HHS within 60 days after the end of the calendar year in which the breach occurred.

Question 4

Which element is NOT required in the documentation of a breach notification sent to affected individuals?

Accepted Answer

The social security numbers of all affected individuals

Answer

Breach notifications to individuals must include a description of the breach, types of information involved, steps to protect themselves, and covered entity contact information, but must never include SSNs.

Question 5

A workforce member improperly accesses PHI but no information is disclosed outside the organization. How should this be documented under HIPAA?

Accepted Answer

The incident must be assessed as a potential breach and the assessment documented, even if it is determined to be an internal violation not requiring notification

Answer

All potential breaches, including internal unauthorized access, must be evaluated and that evaluation documented even if the four-factor analysis determines that patient notification is not required.

(CHP) Certified HIPAA Professional Practice Test

(CHP) Certified HIPAA Professional Practice Test

CHP Documentation & Record Keeping 5