CHPC Investigations and Breach Notification Questions and Answers — Questions and Answers
Question 1: A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025. The clinic provides timely notification to the affected individuals. What is the latest date the clinic must notify the Secretary of HHS?
- Within 60 days of the end of the 2025 calendar year. (Correct answer)
- Within 60 days of discovering the breach.
- Immediately, but no later than 30 business days from discovery.
- Notification to HHS is not required for breaches affecting fewer than 500 individuals.
Correct answer: Within 60 days of the end of the 2025 calendar year.
For breaches affecting fewer than 500 individuals, a covered entity must notify the Secretary of HHS of such breaches annually. These reports are due no later than 60 days after the end of the calendar year in which the breaches were discovered.
Question 2: According to the HIPAA Omnibus Final Rule, when an impermissible use or disclosure of unsecured Protected Health Information (PHI) occurs, what is the presumed status of the incident at the start of an investigation?
- The incident is not a breach unless significant harm to the individual can be proven.
- The incident is only a breach if it involves more than one individual's PHI.
- The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise. (Correct answer)
- The incident is presumed to be a result of accidental employee error and does not require a formal risk assessment.
Correct answer: The incident is presumed to be a breach unless a risk assessment demonstrates a low probability of compromise.
The HITECH Act, as implemented by the Omnibus Rule, establishes a rebuttable presumption that any impermissible use or disclosure of unsecured PHI is a breach. The burden of proof is on the covered entity or business associate to demonstrate through a documented four-factor risk assessment that there is a low probability the PHI has been compromised.
Question 3: A covered entity is preparing individual notification letters following a data breach. Which of the following elements is explicitly required by the HIPAA Breach Notification Rule to be included in the letter?
- The name of the specific workforce member who caused the breach.
- A brief description of the steps individuals should take to protect themselves from potential harm. (Correct answer)
- A formal apology from the organization's CEO.
- An offer of at least one year of complimentary credit monitoring services.
Correct answer: A brief description of the steps individuals should take to protect themselves from potential harm.
The HIPAA Breach Notification Rule at 45 CFR § 164.404(c) specifies the required content for individual notifications. This includes a brief description of the breach, a description of the types of unsecured PHI involved, steps individuals should take to protect themselves, a description of what the covered entity is doing to investigate and mitigate harm, and contact procedures. While offering credit monitoring is a common best practice, it is not explicitly mandated by the rule itself.
Question 4: A hospital's IT department detects unusual network traffic on June 1st. They begin an investigation and on June 10th, they confirm that an unauthorized third party accessed a server containing ePHI. The Privacy Officer is informed on June 11th. For the purposes of the HIPAA Breach Notification Rule, what is the date of "discovery" of the breach?
- June 10th, the date unauthorized access was confirmed.
- June 11th, the date the Privacy Officer was officially informed.
- The date the first affected patient is successfully notified.
- June 1st, the date the first indication of a potential breach was detected. (Correct answer)
Correct answer: June 1st, the date the first indication of a potential breach was detected.
The date of discovery is defined as the first day on which a breach is known to the covered entity, or, by exercising reasonable diligence, would have been known to the covered entity. This includes knowledge held by any member of the workforce or agent. Therefore, the discovery date is June 1st, when the IT department first detected the anomaly. The 60-day notification clock starts from this date.
Question 5: Which of the following situations would most likely be considered an exception to the HIPAA definition of a "breach" and therefore not trigger notification requirements, provided no further impermissible disclosure occurs?
- A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record. (Correct answer)
- An unencrypted laptop containing the PHI of 300 patients is stolen from an employee's locked office.
- A billing clerk intentionally accesses the record of a celebrity patient and sells the information to a tabloid.
- A third-party transcription vendor emails unencrypted patient notes to the wrong clinic, which is not a business associate.
Correct answer: A nurse unintentionally accesses the wrong patient's chart in the EHR but immediately realizes the error and closes the record.
The HIPAA Breach Notification Rule includes an exception for the unintentional acquisition, access, or use of PHI by a workforce member acting in good faith and within the scope of their authority, provided the information is not further used or disclosed impermissibly. The nurse realizing the error and immediately closing the record fits this exception. The other options represent clear potential or actual breaches requiring a full risk assessment.
Question 6: A health insurance company discovers a server misconfiguration that exposed the PHI of 600 members, all of whom reside in the state of Texas. The company has already planned for individual notifications and notification to HHS. What additional notification responsibility does the company have?
- Publish a notice on the homepage of its website for at least 90 days.
- Notify the state's governor's office and attorney general via certified mail.
- Notify prominent media outlets serving the state of Texas. (Correct answer)
- Notify the Federal Trade Commission (FTC) due to the number of individuals affected.
Correct answer: Notify prominent media outlets serving the state of Texas.
Under the HIPAA Breach Notification Rule, if a breach of unsecured PHI affects more than 500 residents of a single state or jurisdiction, the covered entity must provide notice to prominent media outlets serving that state or jurisdiction. This notification must be provided without unreasonable delay and no later than 60 days after discovery. Website posting is an alternative for insufficient contact information, not a primary requirement in this case.
CHPC Investigations and Breach Notification Questions and Answers
A small clinic discovers a breach of unsecured PHI affecting 80 patients on October 15, 2025.
The clinic provides timely notification to the affected individuals.
What is the latest date the clinic must notify the Secretary of HHS?