Practice Test GeeksHIPAA - Health Insurance Portability and Accountability Act Practice Test
← All HIPAA Flashcard Decks

Enforcement and Penalties Flashcards

7 cards from real HIPAA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Enforcement and Penalties flashcards as text

  1. An OCR investigation begins with a complaint. After reviewing the complaint, what is OCR's first enforcement step?

    Answer: Conducting a desk or on-site investigation

    After receiving a complaint, OCR typically conducts an investigation (desk review or on-site) to determine whether a violation occurred before taking any enforcement action.

  2. Which outcome is possible when OCR finds a covered entity in violation but the violation is not due to willful neglect and has been corrected?

    Answer: OCR has discretion to waive civil monetary penalties

    For violations not constituting willful neglect that have been corrected, OCR has discretion to waive civil monetary penalties.

  3. Which of the following actions can a state attorney general take under HIPAA enforcement authority granted by HITECH?

    Answer: Bring a civil action in federal district court on behalf of residents

    State AGs may bring civil actions in federal district court to enjoin violations and obtain damages on behalf of state residents.

  4. A covered entity self-discloses a potential HIPAA violation to OCR through the Voluntary Disclosure Protocol. What is a likely benefit of self-disclosure?

    Answer: Potential for reduced penalties and faster resolution

    Self-disclosure through OCR's protocol can result in reduced penalties and a more efficient resolution, though it does not guarantee complete immunity.

  5. Under HIPAA, can a covered entity face BOTH civil monetary penalties AND criminal prosecution for the same violation?

    Answer: Yes — civil and criminal penalties are distinct and can both apply

    Civil and criminal enforcement are separate tracks under HIPAA, and a covered entity or individual may face both simultaneously for the same conduct.

  6. Which of the following individuals can be held criminally liable under HIPAA?

    Answer: Any person, including employees and workforce members

    HIPAA criminal penalties apply broadly to 'any person' — including employees, contractors, and other workforce members — who knowingly violates HIPAA.

  7. OCR's HIPAA Audit Program, established under HITECH, is designed to:

    Answer: Proactively assess covered entity and business associate compliance

    The HIPAA Audit Program proactively evaluates whether covered entities and business associates comply with HIPAA requirements, independent of complaints.