Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its…

Question

Options

• AIf SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in
• BIf SMH has more than 500 patients in the state of New York, it will need to make separate
• CIf SMH must make a notification in any other state in which it operates, it must also make a
• DIf SMH makes credit monitoring available to individuals who inquire, it will not have to make a

• A
  3% (1)
• B
  13% (5)
• C
  76% (29)
• D
  8% (3)

Explanation

The correct answer is C. If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York. Under the Health Insurance Portability and Accountability Act (HIPAA), SMH is required to notify the Office of Civil Rights (OCR) and the affected individuals of a data breach involving unsecured protected health information (PHI) within 60 days of discovery. However, HIPAA does not preempt state laws that provide greater protection to individuals or impose additional obligations on covered entities. Therefore, SMH must also comply with the state breach notification laws of the states where it operates, including New York. According to the New York State Information Security Breach and Notification Act, any person or business that owns or licenses computerized data that includes private information of a resident of New York must disclose any breach of the security of the system to such resident in the most expedient time possible and without unreasonable delay, unless the exposure of the private information was inadvertent and unlikely to result in misuse or financial harm. Private information includes personal information (such as name, number, or other identifier) plus one or more of the following data elements: social security number; driver's license number or non-driver identification card number; account number, credit or debit card number, in combination with any required security code, access code, password or other information that would permit access to an individual's financial account; biometric information; or a user name or e-mail address in combination with a password or security question and answer that would permit access to an online account3. Therefore, if SMH's data breach involved any of these data elements of New York residents, SMH must notify them of the breach, regardless of whether SMH is compliant with HIPAA, has more than 500 patients in New York, or offers credit monitoring services. SMH must also notify the New York Attorney General, the Department of State, and the Division of State Police within 10 days of notifying the affected individuals. Additionally, SMH must notify the New York Department of Health if the breach involved electronic health records4.

No community discussion yet for this question.