CSP Regulatory Compliance 3

Question 1

Under the HIPAA Breach Notification Rule, a breach affecting more than 500 residents of one state requires notifying which party in addition to the individuals and HHS?

Accepted Answer

Prominent media outlets serving that state

Answer

Breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets in that area.

Question 2

What is the outside deadline for notifying affected individuals of a breach of unsecured PHI under HIPAA?

Accepted Answer

No later than 60 calendar days after discovery

Answer

Notice must be given without unreasonable delay and no later than 60 calendar days after discovery of the breach.

Question 3

A specialty pharmacy contracts with an outside vendor to run its patient refill-reminder calls using PHI. What document is required under HIPAA?

Accepted Answer

Business Associate Agreement

Answer

A vendor that creates, receives, or transmits PHI on behalf of a covered entity is a business associate and requires a BAA.

Question 4

Which federal regulation adds confidentiality protections beyond HIPAA for records from federally assisted substance use disorder treatment programs?

Accepted Answer

42 CFR Part 2

Answer

42 CFR Part 2 restricts disclosure of SUD treatment records from federally assisted programs, which is stricter than HIPAA.

Question 5

Under HIPAA, within how many days must a covered entity generally act on a patient's request to access their PHI?

Accepted Answer

30 days, with one 30-day extension allowed

Answer

The Privacy Rule requires action within 30 days, with one 30-day extension if the individual is notified in writing.

CSP - Certified Specialty Pharmacist Practice Test

CSP - Certified Specialty Pharmacist Practice Test

CSP Regulatory Compliance 3