A Pennsylvania hospital that is a HIPAA covered entity experiences a breach of unencrypted patient data. It is in full compliance with the HIPAA Privacy and Security Rules. Under Pennsylvania's Breach of Personal Information Notification Act, what is the hospital's status regarding the state law's own notification requirements?
A. It is deemed in compliance with the state Act's notification requirements because it is subject to and complies with HIPAA's privacy and security standards
B. It must independently satisfy the state Act's notification requirements in addition to HIPAA, with no credit for HIPAA compliance
C. It is exempt from all breach notification obligations because Pennsylvania law does not apply to health care providers
D. It must notify only the Pennsylvania Attorney General and is excused from notifying affected individuals
Show answer and reasoning
Correct answer: A. It is deemed in compliance with the state Act's notification requirements because it is subject to and complies with HIPAA's privacy and security standards
- B: The Act does not stack a separate notification standard on top of HIPAA for covered entities that already comply with HIPAA's privacy and security standards.
- C: The Act applies broadly, including to health care providers; entities are not blanket-exempt, they are deemed compliant when they meet the HIPAA carve-out.
- D: The Act's HIPAA carve-out addresses the entity's overall notification obligation, not a substitution of regulator notice for individual notice.
Source: 73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act)
Following the 2022 omnibus amendments to Pennsylvania's Breach of Personal Information Notification Act (Act 151 of 2022), a Commonwealth state agency that also functions as a health care provider determines a breach of patient data has occurred. Within how many business days must it notify affected individuals?
A. 72 hours
B. Seven business days
C. 30 calendar days
D. 60 calendar days
Show answer and reasoning
Correct answer: B. Seven business days
- A: 72 hours is a HIPAA Breach Notification Rule-adjacent figure used elsewhere (e.g., some federal reporting contexts), not the Pennsylvania state-agency notice deadline.
- C: 30 days is not the statutory figure the 2022 amendments set for state agencies; it is sometimes cited loosely in secondary summaries but the enacted text sets seven business days.
- D: 60 calendar days has been referenced informally as an outer bound for 'unreasonable delay' by private entities, not as the specific state-agency deadline.
Source: Act of Nov. 3, 2022, P.L. 2139, No. 151 (amending 73 P.S. § 2301 et seq.)
A private-sector Pennsylvania medical billing company (not a state agency) determines a data breach has occurred affecting patient billing records not subject to the HIPAA carve-out. What notification timing standard applies to it under the state Act, as opposed to a fixed day count?
A. Notice must be given within 24 hours of discovery
B. Notice must be given within 10 calendar days of discovery
C. Notice must be given without unreasonable delay following determination of the breach
D. Notice must be given only if requested by the Pennsylvania Department of Health
Show answer and reasoning
Correct answer: C. Notice must be given without unreasonable delay following determination of the breach
- A: Pennsylvania's Act does not set a 24-hour notice trigger for private entities.
- B: Pennsylvania's Act does not set a fixed 10-day figure for private entities; that figure applies under some other states' breach statutes, not Pennsylvania's.
- D: Notification is not contingent on a Department of Health request; the obligation runs to affected individuals based on the breach determination itself.
Source: 73 P.S. § 2301 et seq., as amended by Act of Nov. 3, 2022, P.L. 2139, No. 151
Under Pennsylvania's Breach of Personal Information Notification Act as amended in 2022, the notification clock for private entities runs from the 'determination' of a breach. How does the amended Act define 'determination'?
A. The date the breach first occurred, even if undiscovered
B. The date law enforcement closes its investigation
C. Verification or reasonable certainty that a breach of the security of the system has occurred
D. The date the entity's cyber-insurance carrier is notified
Show answer and reasoning
Correct answer: C. Verification or reasonable certainty that a breach of the security of the system has occurred
- A: The clock runs from determination, not from the underlying occurrence date, which may be unknown for some time.
- B: Law enforcement investigation closure is not the statutory trigger for the notification clock.
- D: Insurance notification is a business step unrelated to the statutory definition of 'determination.'
Source: Act of Nov. 3, 2022, P.L. 2139, No. 151 (amending 73 P.S. § 2301 et seq.)
Where is Pennsylvania's Breach of Personal Information Notification Act codified?
A. 73 P.S. § 2301 et seq.
B. 35 P.S. § 7601 et seq.
C. 50 P.S. § 7111
D. 23 Pa.C.S. § 6339
Show answer and reasoning
Correct answer: A. 73 P.S. § 2301 et seq.
- B: 35 P.S. § 7601 et seq. is the citation for the Confidentiality of HIV-Related Information Act, a different statute.
- C: 50 P.S. § 7111 is the Mental Health Procedures Act's confidentiality-of-records provision, a different statute.
- D: 23 Pa.C.S. § 6339 is the Child Protective Services Law's confidentiality-of-reports provision, a different statute.
Source: 73 P.S. § 2301 et seq. (Breach of Personal Information Notification Act)
