Documentation & Record Keeping Flashcards

Under the HIPAA Breach Notification Rule, how long must documentation of a breach investigation and notification be retained?

Answer: 6 years

Breach notification documentation, including the investigation, risk assessment, and notification records, must be retained for 6 years per HIPAA's standard documentation retention requirement.

What must a covered entity document when determining that a breach does NOT require notification?

Answer: The low probability risk assessment demonstrating that the four-factor analysis supports an exception

When a covered entity concludes a breach does not require notification because there is a low probability that PHI was compromised, it must document the four-factor risk assessment analysis supporting that conclusion.

A covered entity discovers a breach on March 1. By what date must it notify the Secretary of HHS if fewer than 500 individuals were affected?

Answer: Within 60 days after the end of the calendar year in which the breach was discovered

For breaches affecting fewer than 500 individuals, covered entities must report to HHS within 60 days after the end of the calendar year in which the breach occurred.

Which element is NOT required in the documentation of a breach notification sent to affected individuals?

Answer: The social security numbers of all affected individuals

Breach notifications to individuals must include a description of the breach, types of information involved, steps to protect themselves, and covered entity contact information, but must never include SSNs.

A workforce member improperly accesses PHI but no information is disclosed outside the organization. How should this be documented under HIPAA?

Answer: The incident must be assessed as a potential breach and the assessment documented, even if it is determined to be an internal violation not requiring notification

All potential breaches, including internal unauthorized access, must be evaluated and that evaluation documented even if the four-factor analysis determines that patient notification is not required.

What documentation must a covered entity maintain regarding its Notice of Privacy Practices (NPP)?

Answer: All versions of the NPP and the effective dates, retained for 6 years

Covered entities must retain all versions of their NPP along with effective date information for 6 years, as the NPP is a required policy document subject to standard HIPAA retention rules.

A covered entity's Privacy Officer retires. What happens to the documentation retention obligations?

Answer: Documentation obligations transfer to the new Privacy Officer with the same timelines

Documentation retention obligations belong to the covered entity, not the individual Privacy Officer; all retention timelines and records transfer to the successor Privacy Officer unchanged.