HIPAA Breach Notification Rule 5

Question 1

Which HITECH Act provision established the Breach Notification Rule requirements that are now part of HIPAA?

Accepted Answer

Title XIII — Health Information Technology for Economic and Clinical Health

Answer

The HITECH Act (Title XIII of ARRA) established breach notification requirements that were later incorporated into the HIPAA Breach Notification Rule.

Question 2

A healthcare clearinghouse discovers that a subcontractor improperly accessed PHI it was processing. Who is responsible for notifying affected individuals?

Accepted Answer

The healthcare clearinghouse notifies the covered entity, who notifies individuals

Answer

Subcontractors (business associates of business associates) must notify the business associate, who notifies the covered entity, who is ultimately responsible for notifying affected individuals.

Question 3

A health plan mails an Explanation of Benefits to a member's former address, revealing PHI to an unknown person. How is this classified under the Breach Notification Rule?

Accepted Answer

A breach requiring full risk assessment to determine if notification is needed

Answer

Misdirected EOBs involving PHI disclosure to unauthorized individuals require a four-factor risk assessment to determine whether breach notification is required.

Question 4

A ransomware attack encrypts a covered entity's servers containing PHI. Under HHS guidance, how is this typically classified?

Accepted Answer

A breach unless the covered entity can demonstrate a low probability of PHI compromise

Answer

HHS guidance indicates ransomware typically constitutes a breach, but covered entities may conduct a risk assessment and if they can demonstrate low probability of compromise, notification may not be required.

Question 5

What must a covered entity include in the annual breach log submitted to HHS for breaches affecting fewer than 500 individuals?

Accepted Answer

The date of each breach, type of PHI involved, description, and number of individuals affected

Answer

The annual log for small breaches must include the date of the breach, type of PHI, a description of what happened, and the approximate number of individuals affected.

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA - Health Insurance Portability and Accountability Act Practice Test

HIPAA Breach Notification Rule 5