HIPAA Practice Question: For breaches affecting fewer than 500 individuals, HHS must be... | CyberCertPrep
HHSHIPAABreach NotificationEASYFree question
For breaches affecting fewer than 500 individuals, HHS must be notified:
A.Within 90 days of discovery
B.Within 60 days of discovery
C.Within 30 days of discovery
D.No later than 60 days after the end of the calendar year in which the breach was discovered
Why D is correct
Breaches affecting fewer than 500 individuals may be reported to HHS annually, no later than 60 days after the end of the calendar year in which they were discovered.
Know someone studying for HIPAA? Send them this one.
Where this fits in the HIPAA exam
Breach Notification
Covers breach notification concepts and practices within HIPAA.
This question belongs to the "Breach Notification & Enforcement" domain, which makes up about 10% of the HIPAA exam.
CyberCertPrep gives you 20 free HIPAA questions per day with this same answer-and-explanation depth, plus timed exam simulations and progress tracking. No card required.
HIPAA and HHS are trademarks or registered trademarks of their respective owners. CyberCertPrep is an independent exam-preparation resource and is not affiliated with, authorized by, sponsored by, or endorsed by HHS or any other certification body. All study material is independently created; the certification name is used only to identify the exam this resource helps you prepare for.
If ePHI is encrypted using approved methods and is acquired by an unauthorized person, is it a reportable breach?