Reference no: EM133397460

A national hospital information system was hacked and discovered 10 days ago by an external organization and a portion of its personnel, medical and financial information was downloaded to an unauthorized location. Over 10,000 patient records were stolen. In the subsequent investigation by OCR, it was determined that the hospital's IT security management program had not been updated in the past 1 ½ years. There is evidence that the intrusion may have been a result of employees working with a known criminal hacking organization, although this has not yet been proven

1. What are the outcomes from this hack that could be required by the OCR under HIPAA?

New security measures will be required.

The hospital management could face criminal action for negligence in monitoring their employees.

None of the above.

The hospital will need to update their risk management program.

The hospital could pay civil penalties for failing to update their security management program.

All of the above.

The hospital will need to conduct a new risk analysis.

2. What are the potential areas of liability from the last update of the security management program?

There is no liability since criminal activity cannot be predicted.

There is liability if the employees were not adequately trained in security measures.

There is no liability since the update was recent.

3. What are the responsibilities the hospital to report this breach?

This must be reported within 60 days of the occurrence.

This does not need to be reported to the local media.

This must be reported to the individual patients and the OCR.

None of the above.

All of the above.

4. What information is covered by the HIPAA privacy and security rules? (Choose all that apply)

All of the above

None of the above

Financial records related to patients

Financial records related to operations

Medical records

Personnel records