HIPAA Breach Notification Rule 2

Question 1

Under the Breach Notification Rule, what is the deadline for notifying the HHS Secretary about a breach affecting 500 or more individuals?

Accepted Answer

Within 60 days of discovery

Answer

Within 30 days of discovery

Answer

Within 90 days of the end of the calendar year

Answer

Within 60 days after the end of the calendar year in which the breach occurred

Question 2

A hospital's laptop containing unencrypted PHI is stolen. Which factor is NOT part of the four-factor risk assessment used to determine if a breach occurred?

Accepted Answer

The financial cost of the breach to the covered entity

Answer

The nature and extent of the PHI involved

Answer

The unauthorized person who used or could access the PHI

Answer

Whether the PHI was actually acquired or viewed

Question 3

Which of the following is an exception to the Breach Notification Rule that does NOT require notification?

Accepted Answer

An unintentional acquisition of PHI by a workforce member acting in good faith

Answer

A ransomware attack that encrypts PHI

Answer

A stolen laptop with unencrypted PHI

Answer

An email containing PHI sent to the wrong patient

Question 4

If a breach affects fewer than 500 individuals in a state, when must the covered entity notify HHS?

Accepted Answer

Within 60 days after the end of the calendar year

Answer

Within 60 days of discovery

Answer

Within 30 days of discovery

Answer

Within 90 days after the end of the calendar year

Question 5

A business associate discovers a breach of PHI. What is the business associate's primary notification obligation?

Accepted Answer

Notify the covered entity without unreasonable delay and within 60 days of discovery

Answer

Notify affected individuals directly within 60 days

Answer

Notify HHS directly within 60 days

Answer

Notify the media within 60 days if over 500 individuals are affected

Question 6

Which of the following breach notification methods is required when a covered entity cannot locate contact information for 10 or more affected individuals?

Accepted Answer

Posting a notice on the covered entity's website for 90 days

Answer

Certified mail to the last known address

Answer

Email notification to an alternative address

Answer

Publishing a notice in a national newspaper

Question 7

What type of information is NOT required to be included in a breach notification to affected individuals?

Accepted Answer

The names and addresses of all other individuals affected by the breach

Answer

A description of what happened, including the date of the breach

Answer

Steps individuals should take to protect themselves from potential harm

Answer

The types of PHI involved in the breach