HIPAA Breach Notification Rule 2

Question 1

Under the Breach Notification Rule, what is the deadline for notifying the HHS Secretary about a breach affecting 500 or more individuals?

Accepted Answer

Within 60 days of discovery

Answer

Covered entities must notify HHS within 60 days of discovering a breach affecting 500 or more individuals.

Question 2

A hospital's laptop containing unencrypted PHI is stolen. Which factor is NOT part of the four-factor risk assessment used to determine if a breach occurred?

Accepted Answer

The financial cost of the breach to the covered entity

Answer

The four-factor risk assessment does not include financial cost; it focuses on nature of PHI, the unauthorized person, whether PHI was accessed, and extent of risk mitigation.

Question 3

Which of the following is an exception to the Breach Notification Rule that does NOT require notification?

Accepted Answer

An unintentional acquisition of PHI by a workforce member acting in good faith

Answer

Unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within scope of authority is an exception to breach notification.

Question 4

If a breach affects fewer than 500 individuals in a state, when must the covered entity notify HHS?

Accepted Answer

Within 60 days after the end of the calendar year

Answer

For breaches affecting fewer than 500 individuals, covered entities must maintain a log and report to HHS annually within 60 days after the end of each calendar year.

Question 5

A business associate discovers a breach of PHI. What is the business associate's primary notification obligation?

Accepted Answer

Notify the covered entity without unreasonable delay and within 60 days of discovery

Answer

Business associates must notify the covered entity of a breach without unreasonable delay and no later than 60 days after discovering the breach.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Breach Notification Rule 2