CHPS Healthcare Data Breach Response

Question 1

Under the HIPAA Breach Notification Rule, what is the presumption when an impermissible use or disclosure of PHI occurs?

Accepted Answer

The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise

Answer

The event is presumed to be a security incident requiring criminal referral

Answer

The event requires immediate notification to all affected individuals

Answer

The event is presumed harmless unless the patient files a complaint

Question 2

The four-factor risk assessment under the HIPAA Breach Notification Rule includes all of the following EXCEPT:

Accepted Answer

Whether the affected individual has experienced actual identity theft

Answer

Nature and extent of PHI involved including types of identifiers

Answer

Likelihood that PHI was actually acquired or viewed

Answer

The unauthorized person who used or received PHI

Question 3

When must a covered entity notify the Secretary of HHS of a breach affecting fewer than 500 individuals in a single state?

Accepted Answer

Within 60 days of the end of the calendar year in which the breach was discovered

Answer

Within 60 days of discovery

Answer

Within 30 days of breach discovery

Answer

Within 60 days of the breach occurrence date

Question 4

A hospital discovers a breach on March 15. Under HIPAA, individual breach notifications must be sent no later than:

Accepted Answer

May 14 (60 days after discovery)

Answer

April 14 (30 days after discovery)

Answer

June 14 (90 days after discovery)

Answer

March 30 (15 days after discovery)

Question 5

When a breach affects 500 or more residents of a state or jurisdiction, a covered entity must notify which additional party?

Accepted Answer

Prominent media outlets serving the state or jurisdiction

Answer

The state Attorney General only

Answer

The local police department

Answer

The Federal Trade Commission (FTC)

Question 6

Under the HIPAA Breach Notification Rule, which of the following is NOT a required element of individual breach notification?

Accepted Answer

A description of the covered entity's security vulnerabilities that caused the breach

Answer

A brief description of what happened and the date of breach and discovery

Answer

The types of PHI involved in the breach

Answer

Steps individuals should take to protect themselves from potential harm