HIPAA requires a response and reporting of security incidents. What is required when an organization has an attempted unauthorized access of protected health information?

Question

Options

• AHIPAA must be notified
• BNothing is required of an attempted unauthorized access
• CThe organization must respond and notify the appropriate parties
• DFederal authorities must be notified

• A
  4% (1)
• C
  92% (23)
• D
  4% (1)

Explanation

Option C is correct because HIPAA's Security Rule requires covered entities to respond to security incidents - including attempted unauthorized access - and document and report them to appropriate internal parties (e.g., security officers, leadership). The rule does not limit obligations only to successful breaches; attempted incidents trigger the response and documentation requirements as well.

Why the distractors are wrong:

• A is wrong because HIPAA is a law, not an agency you notify - there is no "HIPAA office" to contact for incidents.
• B is the most dangerous misconception: attempted access is explicitly covered under HIPAA's definition of a security incident, so doing nothing violates the rule.
• D is wrong because federal authorities (e.g., FBI, HHS) are not automatically required recipients for every attempted access; notification requirements depend on breach severity and whether PHI was actually compromised.

Memory tip: Think "attempt = action required." HIPAA uses the phrase "respond to and document security incidents" - the word respond covers attempts, not just successes. If someone tries your door, you still log it and tell the right people.

No community discussion yet for this question.