HIPAA Enforcement and Penalties 2

Question 1

Which federal agency is primarily responsible for enforcing HIPAA's Privacy and Security Rules?

Accepted Answer

The Office for Civil Rights (OCR) within HHS

Answer

The Federal Trade Commission (FTC)

Answer

The Department of Justice (DOJ)

Answer

The Centers for Medicare & Medicaid Services (CMS)

Question 2

Under HIPAA's tiered civil penalty structure, what is the minimum penalty per violation for the tier where the covered entity did not know of the violation?

Accepted Answer

$100

Answer

$1,000

Answer

$10,000

Answer

$50,000

Question 3

A covered entity that discovers a potential HIPAA violation and corrects it within 30 days of discovery may avoid civil monetary penalties under which provision?

Accepted Answer

Affirmative defense of correction

Answer

Safe harbor for good faith reliance

Answer

Willful neglect correction exception

Answer

Reasonable cause exemption

Question 4

Criminal HIPAA penalties involving 'wrongful disclosure for commercial advantage, personal gain, or malicious harm' carry a maximum imprisonment term of:

Accepted Answer

10 years

Answer

1 year

Answer

5 years

Answer

20 years

Question 5

State attorneys general were granted authority to bring civil actions for HIPAA violations under which federal legislation?

Accepted Answer

HITECH Act of 2009

Answer

Affordable Care Act of 2010

Answer

GINA of 2008

Answer

Medicare Modernization Act of 2003

Question 6

OCR's resolution agreements typically require a covered entity to pay a monetary settlement AND:

Accepted Answer

Implement a corrective action plan (CAP)

Answer

Terminate all business associate agreements

Answer

Notify every affected patient individually

Answer

Submit to annual third-party audits indefinitely

Question 7

Which of the following best describes 'reasonable cause' in HIPAA's civil penalty tiers?

Accepted Answer

The entity should have known of the violation through ordinary business care

Answer

The entity knew of the violation but chose not to act

Answer

The entity was completely unaware of the violation

Answer

The entity corrected the violation within 30 days