CHPS Healthcare Data Breach Response 3

Question 1

Which of the following organizations maintains the 'Wall of Shame' — the public list of healthcare breaches affecting 500 or more individuals?

Accepted Answer

HHS Office for Civil Rights (OCR)

Answer

The Joint Commission

Answer

NIST National Cybersecurity Center

Answer

The American Health Information Management Association (AHIMA)

Question 2

A hospital's backup tapes containing unencrypted ePHI are discovered missing after a vendor picks them up for off-site storage. Under HIPAA, the hospital should FIRST:

Accepted Answer

Conduct a risk assessment to determine the probability that PHI was compromised

Answer

Immediately send individual notifications to all affected patients

Answer

Submit a report to local law enforcement before notifying HHS

Answer

Wait 60 days before taking action to see if the tapes reappear

Question 3

Under HIPAA, which of the following is an acceptable substitute for individual breach notification when the covered entity has insufficient contact information?

Accepted Answer

Posting conspicuous notice on the covered entity's website for 90 days and notifying major print/broadcast media

Answer

Posting notice on the HHS website

Answer

Calling local community organizations to distribute information

Answer

Filing a report with the state insurance commissioner

Question 4

What is the maximum civil monetary penalty under HIPAA for violations due to willful neglect that are not corrected?

Accepted Answer

$50,000 per violation up to $1.5 million per year

Answer

$10,000 per violation up to $250,000 per year

Answer

$100,000 per violation up to $1.5 million per year

Answer

$250,000 per violation with no annual cap

Question 5

Under HIPAA, which term describes a vendor that provides services to a covered entity and creates, receives, maintains, or transmits PHI in the course of providing those services?

Accepted Answer

Business Associate

Answer

Covered Entity

Answer

Hybrid Entity

Answer

Qualified Service Organization

Question 6

Which federal agency is primarily responsible for enforcing the HIPAA Privacy and Security Rules?

Accepted Answer

HHS Office for Civil Rights (OCR)

Answer

Centers for Medicare & Medicaid Services (CMS)

Answer

Office of the National Coordinator for Health Information Technology (ONC)

Answer

Federal Trade Commission (FTC)