Title: Examine the enforcement of the Privacy and Security Rules and the penalties for noncompliance.
Course: Healthcare Information Security (14157-II) > Section: Exploring HIPAA Basics

Examination should include

- dates compliance requirements went into effect
- enforcement duties of the OCR, such as
  - investigating complaints
  - conducting compliance reviews
  - performing education and outreach
  - interpreting and implementing the confidentiality protections and enforcement provisions in section 922

- violations resulting in
  - civil money penalty (CMP)
  - requests for a hearing by the covered entity

- beneficiary of CMP
- breach notification requirements of secured and unsecured PHI
- Resolution Agreements (https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html)
- The Patient Safety and Quality Improvement Act of 2005 (PSQIA) (https://www.hhs.gov/hipaa/for-professionals/patient-safety/statute-and-rule/index.html).

Process/Skill Questions:

- Who receives the CMP funds? Who at the OCR conducts the official compliance investigation?
- How does the HITECH Act enhance the breach notifications of HIPAA?
- What is the purpose of the PSQIA?