CHPS Healthcare Data Breach Response 2

Question 1

Which of the following events would NOT qualify as a 'breach' under the HIPAA Breach Notification Rule?

Accepted Answer

A workforce member accesses a patient's record for treatment purposes under a valid TPO purpose

Answer

Accessing PHI for legitimate treatment, payment, or operations purposes is not an impermissible use and therefore does not constitute a breach under HIPAA.

Question 2

When a business associate discovers a breach of PHI, within what timeframe must it notify the covered entity?

Accepted Answer

Without unreasonable delay and within 60 days of discovery

Answer

A business associate must notify the covered entity of a breach without unreasonable delay and no later than 60 days following discovery.

Question 3

Under HIPAA, which of the following PHI disposal methods is considered a safe harbor that renders a breach not reportable?

Accepted Answer

Proper destruction (shredding, degaussing) rendering PHI unreadable or indecipherable

Answer

PHI that has been rendered unreadable, indecipherable, or destroyed through proper methods (shredding paper, degaussing/purging media) is excluded from breach notification requirements.

Question 4

A covered entity discovers that a workforce member has been snooping on celebrity patient records over the past year. How many breaches does this represent?

Accepted Answer

One breach per patient record impermissibly accessed

Answer

Each patient's record that was impermissibly accessed represents a separate potential breach requiring individual analysis under the four-factor risk assessment.

Question 5

Under HIPAA, breach discovery is defined as the date on which which party first knows or reasonably should have known of the breach?

Accepted Answer

The covered entity or business associate, whichever is the data holder

Answer

Discovery date is when the covered entity or business associate (whichever holds the data) first knew or should have known about the breach through reasonable diligence.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Healthcare Data Breach Response 2