Health Insurance Portability and Accountability Act (HIPPA) Practice Exam

Which of the following constitutes a breach under HIPAA?

1. Loss of electronic media containing PHI

2. Access by authorized personnel

3. Unintentional sharing of information in a meeting

4. All of the above

The correct answer is: Loss of electronic media containing PHI

A breach under HIPAA occurs when there is an impermissible use or disclosure of protected health information (PHI) that compromises the security or privacy of the information. The loss of electronic media containing PHI directly impacts the confidentiality and integrity of that information, making it a clear example of a breach. When such media is lost, there is a significant risk that unauthorized individuals could access or misuse the sensitive information contained therein. In contrast, authorized personnel accessing PHI is not considered a breach because they are granted permission to handle that information within their designated role. Similarly, unintentional sharing of information in a meeting might not constitute a breach unless it leads to unauthorized access or disclosure. For a situation to qualify as a breach under HIPAA, there typically needs to be a lack of authorization or a significant risk of compromising privacy. Therefore, the only correct indication of a breach from the provided choices is the loss of electronic media, which poses a direct threat to the security of PHI.