CHPC Investigations and Breach Notification Questions and Answers

Question 1

A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025. The clinic provides timely notification to the affected individuals. What is the latest date the clinic must notify the Secretary of HHS?

Accepted Answer

Within 60 days of the end of the 2025 calendar year.

Answer

For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS of such breaches annually. These reports are due no later than 60 days after the end of the calendar year in which the breaches were discovered.

Question 2

According to the HIPAA Omnibus Final Rule, when an impermissible use or disclosure of unsecured Protected Health Information (PHI) occurs, what is the presumed status of the incident at the start of an investigation?

Accepted Answer

The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise.

Answer

The HITECH Act, as implemented by the Omnibus Rule, establishes a rebuttable presumption that any impermissible use or disclosure of unsecured PHI is a breach. The burden of proof is on the covered entity or business associate to demonstrate through a documented four-factor risk assessment that there is a low probability the PHI has been compromised.

Question 3

A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?

Accepted Answer

A brief description of the steps individuals should take to protect themselves from potential harm.

Answer

The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.

Question 4

A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?

Accepted Answer

June 1st, the date the first indication of a potential breach was detected.

Answer

The date of discovery is defined as the first day on which a breach is known to the covered entity, or, by exercising reasonable diligence, would have been known to the covered entity. This includes knowledge held by any member of the workforce or agent. Therefore, the discovery date is June 1st, when the IT department first detected the anomaly. The 60-day notification clock starts from this date.

Question 5

Which of the following situations would most likely be considered an exception to the HIPAA definition of a "breach" and therefore not trigger notification requirements, provided no further impermissible disclosure occurs?

Accepted Answer

A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record.

Answer

The HIPAA Breach Notification Rule includes an exception for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed impermissibly. The nurse realizing the error and immediately closing the record fits this exception. The other options represent clear potential or actual breaches requiring a full risk assessment.

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC - Certified in Healthcare Privacy Compliance Practice Test

CHPC Investigations and Breach Notification Questions and Answers