Investigations and Breach Notification Flashcards

A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025. The clinic provides timely notification to the affected individuals. What is the latest date the clinic must notify the Secretary of HHS?

Answer: Within 60 days of the end of the 2025 calendar year.

For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS of such breaches annually. These reports are due no later than 60 days after the end of the calendar year in which the breaches were discovered.

According to the HIPAA Omnibus Final Rule, when an impermissible use or disclosure of unsecured Protected Health Information (PHI) occurs, what is the presumed status of the incident at the start of an investigation?

Answer: The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise.

The HITECH Act, as implemented by the Omnibus Rule, establishes a rebuttable presumption that any impermissible use or disclosure of unsecured PHI is a breach. The burden of proof is on the covered entity or business associate to demonstrate through a documented four-factor risk assessment that there is a low probability the PHI has been compromised.

A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?

Answer: A brief description of the steps individuals should take to protect themselves from potential harm.

The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.

A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?

Answer: June 1st, the date the first indication of a potential breach was detected.

The date of discovery is defined as the first day on which a breach is known to the covered entity, or, by exercising reasonable diligence, would have been known to the covered entity. This includes knowledge held by any member of the workforce or agent. Therefore, the discovery date is June 1st, when the IT department first detected the anomaly. The 60-day notification clock starts from this date.

Which of the following situations would most likely be considered an exception to the HIPAA definition of a "breach" and therefore not trigger notification requirements, provided no further impermissible disclosure occurs?

Answer: A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record.

The HIPAA Breach Notification Rule includes an exception for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed impermissibly. The nurse realizing the error and immediately closing the record fits this exception. The other options represent clear potential or actual breaches requiring a full risk assessment.

A health insurance company discovers a server misconfiguration that exposed the PHI of 600 members, all of whom reside in the state of Texas. The company has already planned for individual notifications and notification to HHS. What additional notification responsibility does the company have?

Answer: Notify prominent media outlets serving the state of Texas.

Under the HIPAA Breach Notification Rule, if a breach of unsecured PHI affects more than 500 residents of a single state or jurisdiction, the covered entity must provide notice to prominent media outlets serving that state or jurisdiction. This notification must be provided without unreasonable delay and no later than 60 days after discovery. Website posting is an alternative for insufficient contact information, not a primary requirement in this case.