HIPAA Compliance 3 — Questions and Answers
Question 1: What is the maximum civil monetary penalty per violation category for 'willful neglect — not corrected' under HIPAA?
- $10,000 per violation, up to $250,000 annually
- $50,000 per violation, up to $1,000,000 annually
- $100,000 per violation, up to $1,500,000 annually (Correct answer)
- $50,000 per violation, up to $250,000 annually
Correct answer: $100,000 per violation, up to $1,500,000 annually
For willful neglect that is not corrected, HIPAA penalties can reach $100,000 per violation with an annual cap of $1,500,000 for identical violations.
Question 2: A covered entity is performing a risk analysis. Which regulation mandates this activity?
- The HIPAA Privacy Rule
- The HIPAA Security Rule (Correct answer)
- The HIPAA Breach Notification Rule
- The HITECH Act enforcement provisions
Correct answer: The HIPAA Security Rule
The HIPAA Security Rule (45 CFR § 164.308) explicitly requires covered entities to conduct an accurate and thorough assessment of risks to ePHI confidentiality, integrity, and availability.
Question 3: An individual requests an amendment to their PHI in a designated record set. Within how many days must the covered entity act on the request?
- 30 days, with one 30-day extension
- 60 days, with one 30-day extension (Correct answer)
- 90 days, with no extension
- 14 days, with one 14-day extension
Correct answer: 60 days, with one 30-day extension
Covered entities must act on an amendment request within 60 days of receipt, with a single 30-day extension if proper written notice is given.
Question 4: Which of the following best describes 'treatment, payment, and health care operations' (TPO) under HIPAA?
- Uses of PHI that always require patient authorization
- Permissible uses and disclosures of PHI that generally do not require authorization (Correct answer)
- Activities restricted to hospitals and physicians only
- Uses of PHI that require an opportunity to agree or object
Correct answer: Permissible uses and disclosures of PHI that generally do not require authorization
HIPAA permits covered entities to use and disclose PHI for treatment, payment, and health care operations without individual authorization as these are essential health care functions.
Question 5: A covered entity discovers a breach of unsecured PHI affecting 600 individuals. Who must be notified, and by when?
- Only the individuals affected, within 60 days
- The individuals and HHS, within 60 days of discovery
- HHS and media, within 30 days, and individuals within 60 days
- Individuals within 60 days, and HHS within 60 days, and prominent media within 60 days (Correct answer)
Correct answer: Individuals within 60 days, and HHS within 60 days, and prominent media within 60 days
For breaches affecting 500+ residents of a state or jurisdiction, covered entities must notify individuals, HHS, and prominent local media within 60 days of discovery.
Question 6: Under the HIPAA Privacy Rule, psychotherapy notes receive special protection because they:
- Are excluded from the definition of PHI entirely
- Require separate authorization for most disclosures, even from the rest of the medical record (Correct answer)
- Can only be disclosed with a court order
- Must be destroyed after 5 years
Correct answer: Require separate authorization for most disclosures, even from the rest of the medical record
Psychotherapy notes are specially protected under HIPAA and generally require separate, specific authorization for disclosure, even when other PHI from the same record could be disclosed without authorization.
Question 7: A workforce member who is a victim of domestic violence may receive which special HIPAA accommodation regarding their PHI?
- They may restrict all disclosures to their employer
- They may request that communications be sent to an alternative address or by alternative means (Correct answer)
- They are automatically excluded from all research uses of PHI
- They may demand that their records be destroyed immediately
Correct answer: They may request that communications be sent to an alternative address or by alternative means
HIPAA's Privacy Rule gives individuals the right to request confidential communications, such as receiving appointment reminders at an alternate address, which providers must accommodate if reasonable.
HIPAA Compliance 3
What is the maximum civil monetary penalty per violation category for 'willful neglect — not corrected' under HIPAA?