CAS-003 · Question #12
A hospital's security team recently determined its network was breached and patient data was accessed by an external entity. The Chief Information Security Officer (CISO) of the hospital approaches…
The correct answer is A. When it is mandated by their legal and regulatory requirements. For a hospital, breach notification to affected patients is governed by HIPAA, which mandates specific disclosure timelines regardless of business or PR considerations.
Question
A hospital's security team recently determined its network was breached and patient data was accessed by an external entity. The Chief Information Security Officer (CISO) of the hospital approaches the executive management team with this information, reports the vulnerability that led to the breach has already been remediated, and explains the team is continuing to follow the appropriate incident response plan. The executive team is concerned about the hospital's brand reputation and asks the CISO when the incident should be disclosed to the affected patients. Which of the following is the MOST appropriate response?
Options
- AWhen it is mandated by their legal and regulatory requirements
- BAs soon as possible in the interest of the patients
- CAs soon as the public relations department is ready to be interviewed
- DWhen all steps related to the incident response plan are completed
- EUpon the approval of the Chief Executive Officer (CEO) to release information to the public
How the community answered
(32 responses)- A81% (26)
- C9% (3)
- D3% (1)
- E6% (2)
Why each option
For a hospital, breach notification to affected patients is governed by HIPAA, which mandates specific disclosure timelines regardless of business or PR considerations.
Under HIPAA's Breach Notification Rule, covered entities such as hospitals are legally required to notify affected individuals within 60 days of discovering a breach of unsecured protected health information. This regulatory obligation takes precedence over internal incident response completion, PR readiness, or executive approval - the legal requirement defines when disclosure must occur.
While notifying patients quickly is ethically desirable, 'as soon as possible' is not a legally precise standard and could conflict with the need to confirm scope, contain the breach, and prepare accurate notifications.
PR department readiness is irrelevant to the legal obligation to notify patients and could improperly delay mandatory disclosure.
Waiting for all incident response steps to be completed could cause the organization to miss the legally mandated notification deadline.
CEO approval is an internal governance step and does not override or define the externally imposed legal timeline for patient notification.
Concept tested: HIPAA breach notification requirements for healthcare organizations
Source: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
Topics
Community Discussion
No community discussion yet for this question.