Enforcement and Penalties Flashcards
7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Enforcement and Penalties flashcards as text
A covered entity receives an OCR notice of proposed determination imposing a civil monetary penalty. The entity disagrees. What is its next step?
Answer: Request a hearing before an Administrative Law Judge (ALJ)
A covered entity that contests an OCR civil monetary penalty may request a hearing before an HHS Administrative Law Judge within 90 days.
Which of the following best describes the difference between a 'resolution agreement' and a 'civil monetary penalty' in HIPAA enforcement?
Answer: Resolution agreements are voluntary settlements; CMPs are formally imposed penalties
Resolution agreements are negotiated, voluntary settlements between OCR and the covered entity, while civil monetary penalties are formally imposed through an administrative enforcement process.
After an ALJ decision in a HIPAA civil penalty case, what further appeal options exist?
Answer: Appeal to the HHS Departmental Appeals Board, then federal court
After an ALJ decision, either party may appeal to the HHS Departmental Appeals Board, and the final agency decision is then subject to review in federal court.
A covered entity corrects a HIPAA violation within 30 days of OCR notification. Under which penalty tier does this correction provision NOT eliminate liability?
Answer: Tier 4 — willful neglect, not corrected
The 30-day correction window provides an affirmative defense for Tiers 1–3, but Tier 4 (willful neglect, not corrected) carries mandatory penalties that cannot be avoided by late correction.
Which of the following HIPAA violations would OCR most likely treat as a priority for investigation?
Answer: A systematic failure to provide patients with Notice of Privacy Practices affecting thousands
OCR prioritizes investigations involving systemic failures, large numbers of individuals, or patterns of non-compliance over isolated, low-impact incidents.
When HHS imposes a civil monetary penalty, the funds are deposited into:
Answer: The general fund of the U.S. Treasury
Civil monetary penalties collected under HIPAA are deposited into the general fund of the U.S. Treasury (with a portion potentially distributed to harmed individuals per HITECH).
A covered entity reports a breach affecting 450 individuals but fails to notify HHS within 60 days of the end of the calendar year. Which HIPAA rule has been violated?
Answer: The Breach Notification Rule's annual reporting requirement
For breaches affecting fewer than 500 individuals, covered entities must report to HHS no later than 60 days after the end of the calendar year in which the breaches occurred.