Certified In Healthcare Privacy And Security (CHPS) Practice

The question tests understanding of how HIPAA breach notifications to HHS differ by the number of individuals affected. If a breach affects 500 or more people, the entity must notify HHS within 60 days after discovery. But when the breach involves fewer than 500 individuals, the rule requires an annual notification/report to HHS, not a 60-day notice. Since the breach happened on September 25, 2015 and involves fewer than 500 people, the required action is an annual report to HHS due the following year, by the end of the first quarter. That means no later than March 31, 2016. This is why March 31, 2016 is the latest acceptable date. (Note: notification to affected individuals is a separate requirement and would occur within 60 days of discovery, independent of the HHS reporting deadline.)