CHPS Healthcare Data Breach Response 2

Question 1

Which of the following events would NOT qualify as a 'breach' under the HIPAA Breach Notification Rule?

Accepted Answer

A workforce member accesses a patient's record for treatment purposes under a valid TPO purpose

Answer

A workforce member accidentally emails a patient's discharge summary to the wrong provider

Answer

A laptop containing unencrypted ePHI is stolen from a locked car

Answer

A billing clerk views patient records that are unrelated to her job function

Question 2

When a business associate discovers a breach of PHI, within what timeframe must it notify the covered entity?

Accepted Answer

Without unreasonable delay and within 60 days of discovery

Answer

Immediately, with no delay

Answer

Within 30 days of discovery

Answer

Within 24 hours of discovery

Question 3

Under HIPAA, which of the following PHI disposal methods is considered a safe harbor that renders a breach not reportable?

Accepted Answer

Proper destruction (shredding, degaussing) rendering PHI unreadable or indecipherable

Answer

Deleting files from a computer hard drive

Answer

Moving PHI to a secure internal archive

Answer

Applying password protection to PHI files

Question 4

A covered entity discovers that a workforce member has been snooping on celebrity patient records over the past year. How many breaches does this represent?

Accepted Answer

One breach per patient record impermissibly accessed

Answer

One breach per year

Answer

A single breach because it involves one workforce member

Answer

No breach if the workforce member did not disclose the information to anyone

Question 5

Under HIPAA, breach discovery is defined as the date on which which party first knows or reasonably should have known of the breach?

Accepted Answer

The covered entity or business associate, whichever is the data holder

Answer

The individual whose PHI was breached

Answer

The covered entity, regardless of when the business associate discovered it

Answer

The HHS Office for Civil Rights (OCR)

Question 6

What type of PHI is specifically excluded from the HIPAA Breach Notification Rule's definition of PHI for breach purposes?

Accepted Answer

PHI in a Limited Data Set

Answer

PHI in oral form

Answer

PHI in paper form

Answer

PHI maintained in EHR systems