HIPAA - Health Insurance Portability and Accountability Act HIPAA Breach Notification Rule Questions and Answers

Question 1

A hospital discovers that a server containing the electronic protected health information (ePHI) of 350 patients was improperly decommissioned and sold. The data was not encrypted. According to the HIPAA Breach Notification Rule, what is the hospital's deadline for notifying the Secretary of Health and Human Services (HHS)?

Accepted Answer

No later than 60 days after the end of the calendar year in which the breach was discovered.

Answer

For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS by submitting a report no later than 60 days after the end of the calendar year in which the breach was discovered. The 60-day deadline from the date of discovery applies to notifying individuals and to notifying the Secretary for breaches affecting 500 or more individuals.

Question 2

A business associate of a covered entity experiences a data breach involving unsecured PHI. According to the HIPAA Breach Notification Rule, what is the primary responsibility of the business associate?

Accepted Answer

To notify the covered entity of the breach without unreasonable delay.

Answer

The HIPAA Breach Notification Rule requires a business associate to notify the covered entity after discovering a breach of unsecured PHI. This notification must occur without unreasonable delay and no later than 60 days from discovery. The covered entity is ultimately responsible for notifying affected individuals, the Secretary, and the media, as applicable.

Question 3

Which of the following situations would NOT be considered a 'breach' under the HIPAA Breach Notification Rule, thereby exempting the organization from notification requirements?

Accepted Answer

A billing employee unintentionally accesses the record of a patient they are not treating, realizes the mistake immediately, and does not further use or disclose the information.

Answer

The HIPAA Breach Notification Rule includes three exceptions to the definition of a breach. One exception is for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed. The other scenarios represent clear breaches requiring notification.

Question 4

A large health insurance company experiences a breach affecting 1,000 members residing in the same state. In addition to notifying the affected individuals and the Secretary of HHS, what other notification is required by the HIPAA Breach Notification Rule?

Accepted Answer

Notify prominent media outlets serving the state or jurisdiction.

Answer

For breaches of unsecured PHI that affect more than 500 residents of a single state or jurisdiction, the covered entity is required to provide notice to prominent media outlets serving that area. This must be done without unreasonable delay and no later than 60 days after the discovery of the breach.

Question 5

A covered entity is preparing a breach notification letter for affected individuals. Which of the following elements is explicitly required to be included in the notice according to the Breach Notification Rule?

Accepted Answer

A brief description of what the entity is doing to investigate the breach and prevent future breaches.

Answer

The HIPAA Breach Notification Rule specifies several required elements for individual notifications. These include a brief description of the breach, the types of information involved, steps individuals should take to protect themselves, what the entity is doing to investigate, mitigate harm, and prevent future breaches, and contact information.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act HIPAA Breach Notification Rule Questions and Answers