CHPS Healthcare Data Breach Response

Question 1

Under the HIPAA Breach Notification Rule, what is the presumption when an impermissible use or disclosure of PHI occurs?

Accepted Answer

The event is presumed to be a breach unless the covered entity demonstrates low probability of PHI compromise

Answer

Under the 2013 Omnibus Rule, an impermissible use or disclosure is presumed to be a breach unless a covered entity can demonstrate through a four-factor risk assessment that there is a low probability the PHI was compromised.

Question 2

The four-factor risk assessment under the HIPAA Breach Notification Rule includes all of the following EXCEPT:

Accepted Answer

Whether the affected individual has experienced actual identity theft

Answer

Actual identity theft is not one of the four factors — the assessment focuses on probability of compromise, not actual harm after the fact.

Question 3

When must a covered entity notify the Secretary of HHS of a breach affecting fewer than 500 individuals in a single state?

Accepted Answer

Within 60 days of the end of the calendar year in which the breach was discovered

Answer

Small breaches (fewer than 500 individuals) must be logged and reported to HHS annually no later than 60 days after the end of the calendar year in which they were discovered.

Question 4

A hospital discovers a breach on March 15. Under HIPAA, individual breach notifications must be sent no later than:

Accepted Answer

May 14 (60 days after discovery)

Answer

Individual notifications must be provided without unreasonable delay and no later than 60 days following discovery of the breach.

Question 5

When a breach affects 500 or more residents of a state or jurisdiction, a covered entity must notify which additional party?

Accepted Answer

Prominent media outlets serving the state or jurisdiction

Answer

When a breach affects 500 or more residents of a state, the covered entity must provide notice to prominent media outlets in addition to individual and HHS notification.

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS - Certified in Healthcare Privacy and Security Practice Test

CHPS Healthcare Data Breach Response