A Pennsylvania hospital that is a HIPAA covered entity experiences a breach of unencrypted patient data. It is in full compliance with the HIPAA Privacy and Security Rules. Under Pennsylvania's Breach of Personal Information Notification Act, what is the hospital's status regarding the state law's own notification requirements?
A. It is deemed in compliance with the state Act's notification requirements because it is subject to and complies with HIPAA's privacy and security standards
B. It must independently satisfy the state Act's notification requirements in addition to HIPAA, with no credit for HIPAA compliance
C. It is exempt from all breach notification obligations because Pennsylvania law does not apply to health care providers
D. It must notify only the Pennsylvania Attorney General and is excused from notifying affected individuals
Source: 73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act)
Following the 2022 omnibus amendments to Pennsylvania's Breach of Personal Information Notification Act (Act 151 of 2022), a Commonwealth state agency that also functions as a health care provider determines a breach of patient data has occurred. Within how many business days must it notify affected individuals?
A. 72 hours
B. Seven business days
C. 30 calendar days
D. 60 calendar days
Source: Act of Nov. 3, 2022, P.L. 2139, No. 151 (amending 73 P.S. § 2301 et seq.)
A private-sector Pennsylvania medical billing company (not a state agency) determines a data breach has occurred affecting patient billing records not subject to the HIPAA carve-out. What notification timing standard applies to it under the state Act, as opposed to a fixed day count?
A. Notice must be given within 24 hours of discovery
B. Notice must be given within 10 calendar days of discovery
C. Notice must be given without unreasonable delay following determination of the breach
D. Notice must be given only if requested by the Pennsylvania Department of Health
Source: 73 P.S. § 2301 et seq., as amended by Act of Nov. 3, 2022, P.L. 2139, No. 151
Under Pennsylvania's Breach of Personal Information Notification Act as amended in 2022, the notification clock for private entities runs from the 'determination' of a breach. How does the amended Act define 'determination'?
A. The date the breach first occurred, even if undiscovered
B. The date law enforcement closes its investigation
C. Verification or reasonable certainty that a breach of the security of the system has occurred
D. The date the entity's cyber-insurance carrier is notified
Source: Act of Nov. 3, 2022, P.L. 2139, No. 151 (amending 73 P.S. § 2301 et seq.)
Where is Pennsylvania's Breach of Personal Information Notification Act codified?
A. 73 P.S. § 2301 et seq.
B. 35 P.S. § 7601 et seq.
C. 50 P.S. § 7111
D. 23 Pa.C.S. § 6339
Source: 73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act)
