Enforcement and Penalties Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Enforcement and Penalties flashcards as text
Which federal agency is primarily responsible for enforcing HIPAA's Privacy and Security Rules?
Answer: The Office for Civil Rights (OCR) within HHS
The HHS Office for Civil Rights (OCR) is the primary federal agency responsible for enforcing HIPAA's Privacy and Security Rules.
Under HIPAA's tiered civil penalty structure, what is the minimum penalty per violation for the tier where the covered entity did not know of the violation?
Answer: $100
The lowest tier (unknowing violation) carries a minimum penalty of $100 per violation.
A covered entity that discovers a potential HIPAA violation and corrects it within 30 days of discovery may avoid civil monetary penalties under which provision?
Answer: Affirmative defense of correction
HIPAA provides an affirmative defense (correction within 30 days) that can shield a covered entity from civil monetary penalties if it corrects the violation promptly.
Criminal HIPAA penalties involving 'wrongful disclosure for commercial advantage, personal gain, or malicious harm' carry a maximum imprisonment term of:
Answer: 10 years
The most severe criminal tier under HIPAA provides for up to 10 years in prison when the offense involves commercial advantage, personal gain, or malicious harm.
State attorneys general were granted authority to bring civil actions for HIPAA violations under which federal legislation?
Answer: HITECH Act of 2009
The HITECH Act of 2009 granted state attorneys general the right to bring civil actions on behalf of state residents for HIPAA violations.
OCR's resolution agreements typically require a covered entity to pay a monetary settlement AND:
Answer: Implement a corrective action plan (CAP)
Resolution agreements include both a financial settlement and a corrective action plan (CAP) outlining the steps the entity must take to achieve compliance.
Which of the following best describes 'reasonable cause' in HIPAA's civil penalty tiers?
Answer: The entity should have known of the violation through ordinary business care
Reasonable cause means the covered entity knew or should have known of the violation through ordinary diligence, but it did not constitute willful neglect.