CHPS Healthcare Data Breach Response 3

Question 1

Which of the following organizations maintains the 'Wall of Shame' — the public list of healthcare breaches affecting 500 or more individuals?

Accepted Answer

HHS Office for Civil Rights (OCR)

Answer

OCR maintains the public breach portal (colloquially called the 'Wall of Shame') listing breaches affecting 500 or more individuals as required by HITECH.

Question 2

A hospital's backup tapes containing unencrypted ePHI are discovered missing after a vendor picks them up for off-site storage. Under HIPAA, the hospital should FIRST:

Accepted Answer

Conduct a risk assessment to determine the probability that PHI was compromised

Answer

Before triggering breach notification, the covered entity must conduct the four-factor risk assessment to determine whether there is a low probability of PHI compromise.

Question 3

Under HIPAA, which of the following is an acceptable substitute for individual breach notification when the covered entity has insufficient contact information?

Accepted Answer

Posting conspicuous notice on the covered entity's website for 90 days and notifying major print/broadcast media

Answer

When direct contact information is unavailable, substitute notice may be provided by posting on the covered entity's website for 90 days or in major print or broadcast media serving the affected area.

Question 4

What is the maximum civil monetary penalty under HIPAA for violations due to willful neglect that are not corrected?

Accepted Answer

$50,000 per violation up to $1.5 million per year

Answer

Willful neglect violations not corrected carry penalties of $50,000 per violation up to a maximum of $1.5 million per calendar year for identical violations.

Question 5

Under HIPAA, which term describes a vendor that provides services to a covered entity and creates, receives, maintains, or transmits PHI in the course of providing those services?

Accepted Answer

Business Associate

Answer

A business associate is a person or entity that performs services for a covered entity involving the use or disclosure of PHI, and must sign a Business Associate Agreement.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Healthcare Data Breach Response 3