Healthcare & Financial Privacy Flashcards

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach of unsecured PHI within:

Answer: 60 days of discovery

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of the breach.

HIPAA enforcement actions for civil violations are primarily handled by which agency?

Answer: The Department of Health and Human Services Office for Civil Rights (HHS OCR)

HHS OCR is the primary federal enforcement body for HIPAA civil violations, including failure to safeguard PHI and improper disclosures.

Under the HIPAA 'Safe Harbor' de-identification method, PHI is considered de-identified when:

Answer: All 18 specified categories of identifiers are removed and the covered entity has no actual knowledge the remaining information can re-identify an individual

The Safe Harbor method requires removal of all 18 enumerated identifiers and a certification that the covered entity has no actual knowledge the remaining data could re-identify individuals.

The HITECH Act significantly strengthened HIPAA by making which of the following changes?

Answer: Business associates became directly liable for compliance with certain HIPAA provisions

The HITECH Act extended direct HIPAA liability to business associates, increased civil monetary penalties, and strengthened breach notification requirements.

The FTC Act's authority to regulate health data practices applies in which of the following circumstances?

Answer: To companies not covered by HIPAA that collect health-related information, under the prohibition on unfair or deceptive practices

The FTC uses Section 5 of the FTC Act to regulate health data privacy for entities outside HIPAA's scope, such as fitness apps and direct-to-consumer health platforms.

Under the FCRA, the statute of limitations for filing a civil lawsuit for a violation is generally:

Answer: 2 years from discovery of the violation or 5 years from the date of the violation, whichever is earlier

FCRA civil actions must be brought within 2 years after the date of discovery of the violation, or within 5 years of the violation, whichever comes first.