HIPAA Breach Notification Rule 3

Question 1

Under the Breach Notification Rule, when does the 60-day notification clock begin for a business associate who discovers a breach?

Accepted Answer

When the business associate discovers the breach

Answer

The 60-day clock for business associate notification to covered entities begins on the date the business associate discovers the breach, not when the breach occurred.

Question 2

Which of the following breaches would require media notification under the HIPAA Breach Notification Rule?

Accepted Answer

A breach affecting 600 patients in a single state

Answer

Media notification is required when a breach affects more than 500 residents of a state or jurisdiction.

Question 3

An employee accidentally emails PHI to a wrong recipient who is also a healthcare employee and does not open or read it. Under which exception might this NOT be classified as a reportable breach?

Accepted Answer

The inadvertent disclosure exception where the recipient could not reasonably retain the information

Answer

Inadvertent disclosure of PHI between authorized persons where the recipient could not reasonably have retained the information is an exception to the definition of breach.

Question 4

A covered entity conducts a risk assessment after discovering that an employee inappropriately accessed patient records. The assessment determines there is a low probability that PHI was compromised. What should the covered entity do?

Accepted Answer

No notification is required if the risk assessment shows low probability of compromise

Answer

If the risk assessment demonstrates low probability that PHI was compromised, the covered entity may determine no breach notification is required.

Question 5

How must a covered entity notify individuals affected by a breach if they have email addresses on file and individuals have agreed to electronic notice?

Accepted Answer

Email notification is permitted if the individual has agreed to receive electronic notice

Answer

Covered entities may use email for breach notification if the individual has previously agreed to receive notices electronically.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Breach Notification Rule 3