A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

Question

Quizplus · Accepted Answer

Under HIPAA, a covered entity must report a breach of PHI affecting more than 500 individuals to the Department of Health and Human Services, the affected individuals, and the local media. There is no requirement to report the breach to medical providers unless they are directly affected.

A Covered Entity Suffers a Ransomware Attack That Affects the Personal