CHPC Investigations and Breach Notification Questions and Answers

Question 1

A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025.
The clinic provides timely notification to the affected individuals.
What is the latest date the clinic must notify the Secretary of HHS?

Accepted Answer

Within 60 days of the end of the 2025 calendar year.

Answer

Within 60 days of discovering the breach.

Answer

Immediately, but no later than 30 business days from discovery.

Answer

Notification to HHS is not required for breaches affecting fewer than 500 individuals.

Question 2

According to the HIPAA Omnibus Final Rule, when an impermissible use or disclosure of unsecured Protected Health Information (PHI) occurs, what is the presumed status of the incident at the start of an investigation?

Accepted Answer

The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise.

Answer

The incident is not a breach unless significant harm to the individual can be proven.

Answer

The incident is only a breach if it involves more than one individual's PHI.

Answer

The incident is presumed to be a result of accidental employee error and does not require a formal risk assessment.

Question 3

A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?

Accepted Answer

A brief description of the steps individuals should take to protect themselves from potential harm.

Answer

The name of the specific workforce member who caused the breach.

Answer

A formal apology from the organization's CEO.

Answer

An offer of at least one year of complimentary credit monitoring services.

Question 4

A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?

Accepted Answer

June 1st, the date the first indication of a potential breach was detected.

Answer

June 10th, the date unauthorized access was confirmed.

Answer

June 11th, the date the Privacy Officer was officially informed.

Answer

The date the first affected patient is successfully notified.

Question 5

Which of the following situations would most likely be considered an exception to the HIPAA definition of a "breach" and therefore not trigger notification requirements, provided no further impermissible disclosure occurs?

Accepted Answer

A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record.

Answer

An unencrypted laptop containing the PHI of 300 patients is stolen from an employee's locked office.

Answer

A billing clerk intentionally accesses the record of a celebrity patient and sells the information to a tabloid.

Answer

A third-party transcription vendor emails unencrypted patient notes to the wrong clinic, which is not a business associate.

Question 6

A health insurance company discovers a server misconfiguration that exposed the PHI of 600 members, all of whom reside in the state of Texas. The company has already planned for individual notifications and notification to HHS. What additional notification responsibility does the company have?

Accepted Answer

Notify prominent media outlets serving the state of Texas.

Answer

Publish a notice on the homepage of its website for at least 90 days.

Answer

Notify the state's governor's office and attorney general via certified mail.

Answer

Notify the Federal Trade Commission (FTC) due to the number of individuals affected.

A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025.The clinic provides timely notification to the affected individuals.What is the latest date the clinic must notify the Secretary of HHS?

A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025.
The clinic provides timely notification to the affected individuals.
What is the latest date the clinic must notify the Secretary of HHS?