HIPAA HITECH Act and Technology Requirements 2 — Questions and Answers
Question 1: Under the HITECH Act, what is the minimum penalty per violation for 'willful neglect' that is not corrected within 30 days?
- $1,000
- $10,000
- $50,000 (Correct answer)
- $100,000
Correct answer: $50,000
Willful neglect not corrected within 30 days carries a minimum penalty of $50,000 per violation under HITECH's tiered penalty structure.
Question 2: Which HITECH Act provision requires covered entities to provide patients with an electronic copy of their PHI upon request?
- Breach Notification Rule
- Right of Access provision (Correct answer)
- Meaningful Use requirement
- Business Associate expansion
Correct answer: Right of Access provision
HITECH's Right of Access provision requires covered entities using EHRs to provide patients with electronic copies of their PHI when requested.
Question 3: What does the HITECH Act require regarding accounting of disclosures for covered entities using EHR systems?
- Disclosures for treatment must be tracked for 3 years
- Accounting must include treatment, payment, and operations disclosures (Correct answer)
- Only disclosures for marketing need to be tracked
- Accounting requirements are eliminated for EHR users
Correct answer: Accounting must include treatment, payment, and operations disclosures
HITECH expanded accounting of disclosures requirements to include treatment, payment, and operations disclosures for covered entities using EHR systems.
Question 4: Under HITECH, which entity type became directly liable for HIPAA compliance even without a business associate agreement in place?
- Subcontractors of business associates (Correct answer)
- Health information exchanges
- Clearinghouses
- Cloud hosting providers
Correct answer: Subcontractors of business associates
HITECH made subcontractors of business associates directly liable for HIPAA compliance, extending the compliance chain beyond direct business associates.
Question 5: What is the maximum annual cap for violations of an identical provision under HITECH's penalty structure?
- $250,000
- $500,000
- $1,000,000
- $1,500,000 (Correct answer)
Correct answer: $1,500,000
HITECH caps annual penalties for violations of an identical provision at $1,500,000 per calendar year regardless of the tier.
Question 6: Which HITECH provision restricts covered entities from selling electronic PHI for marketing without patient authorization?
- Safe harbor encryption provision
- Minimum necessary standard
- Restrictions on sale of PHI (Correct answer)
- Notice of Privacy Practices requirement
Correct answer: Restrictions on sale of PHI
HITECH's restrictions on sale of PHI prohibit covered entities from receiving remuneration in exchange for PHI without patient authorization.
Question 7: Under the HITECH Act, within how many days must a business associate notify a covered entity of a breach discovery?
- 30 days
- 45 days
- 60 days (Correct answer)
- 72 hours
Correct answer: 60 days
Business associates must notify covered entities of a discovered breach within 60 days of discovery under HITECH's breach notification requirements.
HIPAA HITECH Act and Technology Requirements 2
Under the HITECH Act, what is the minimum penalty per violation for 'willful neglect' that is not corrected within 30 days?