MPJE: Multistate Pharmacy Jurisprudence Examination Quiz: Phi Safeguards
10 questions · exam conditions
0:00
Phi SafeguardsQuestion 1 of 10

A pharmacy operates in a state that has a law requiring notification to individuals within 30 calendar days of the discovery of a PHI breach. The federal HIPAA rule allows for notification within 60 calendar days. If this pharmacy discovers a breach, which timeline must it follow?

The 60-day HIPAA timeline, because federal law preempts state law in matters of healthcare privacy.
A 90-day timeline, which is the sum of the state and federal requirements.
The pharmacy may choose which timeline to follow, as long as it notifies the state attorney general.
The 30-day state law timeline, because it provides greater protection to the individual.
← Back to quizzes

MPJE: Multistate Pharmacy Jurisprudence Examination Quiz

MPJE: Multistate Pharmacy Jurisprudence Examination Quiz: Phi Safeguards

Practice Phi Safeguards in MPJE: Multistate Pharmacy Jurisprudence Examination with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Phi Safeguards, giving you a quick way to practice the rules, question types, and explanations that matter most for MPJE: Multistate Pharmacy Jurisprudence Examination.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A pharmacy operates in a state that has a law requiring notification to individuals within 30 calendar days of the discovery of a PHI breach. The federal HIPAA rule allows for notification within 60 calendar days. If this pharmacy discovers a breach, which timeline must it follow?

  1. The 60-day HIPAA timeline, because federal law preempts state law in matters of healthcare privacy.
  2. A 90-day timeline, which is the sum of the state and federal requirements.
  3. The pharmacy may choose which timeline to follow, as long as it notifies the state attorney general.
  4. The 30-day state law timeline, because it provides greater protection to the individual. (correct answer)
Explanation: The HIPAA Privacy Rule provides a federal floor of privacy protections. It does not preempt state laws that are more stringent, meaning those that provide greater privacy protections to individuals. A shorter timeframe for breach notification is considered more stringent. Therefore, the pharmacy must comply with the 30-day notification deadline imposed by its state law.

Question 2

A pharmacist drops a filled, labeled prescription vial behind the pharmacy counter. It rolls under a shelving unit and is not found for approximately 20 minutes, during which time the pharmacy was open and staffed. After retrieving the vial, the pharmacist-in-charge (PIC) conducts a risk assessment. Which of the following actions is most appropriate?

  1. Notify the patient of a potential breach without unreasonable delay, as PHI was not secured.
  2. Report the incident to the HHS Office for Civil Rights (OCR) within 60 days as a minor breach.
  3. Conclude there is a low probability of compromise and document the incident and risk assessment. (correct answer)
  4. Take no further action as the vial remained within the confines of the prescription department.
Explanation: Under the HIPAA Breach Notification Rule, an impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity demonstrates that there is a low probability that the PHI has been compromised. A risk assessment for this scenario would likely conclude that since the vial remained in a secure, staff-only area, the probability of compromise is low. However, HIPAA requires that the incident and the risk assessment be documented. Notifying the patient or HHS is not required if the risk of compromise is low. Taking no action at all is incorrect because the documentation of the assessment is a required step.

Question 3

A health system's central pharmacy discovers that a server containing the unencrypted electronic protected health information (ePHI) of 800 patients from a single metropolitan area was stolen. Following an investigation, the pharmacy determines this is a reportable breach. In addition to notifying the affected individuals, the pharmacy must notify:

  1. the Secretary of HHS within 60 days of the end of the calendar year.
  2. prominent media outlets serving the area within 60 days of discovering the breach. (correct answer)
  3. the Drug Enforcement Administration (DEA) due to the potential presence of controlled substance data.
  4. all local law enforcement agencies in the counties where affected patients reside.
Explanation: For a breach of unsecured PHI affecting more than 500 residents of a state or jurisdiction, HIPAA requires the covered entity to provide notice to prominent media outlets serving the state or jurisdiction. This notification must be provided without unreasonable delay and in no case later than 60 calendar days following the discovery of the breach. The Secretary of HHS must also be notified without unreasonable delay (concurrently with individual notices), not annually. The DEA and local law enforcement do not have a primary role in PHI breach notification, although law enforcement may be involved in the theft investigation.

Question 4

A pharmacy technician inadvertently emails a patient's medication reconciliation report to an incorrect email address. The unintended recipient, who is unknown to the pharmacy, replies stating, "This was sent to me by mistake. I have deleted it." The pharmacy has no reason to doubt the recipient's statement. What is the pharmacy's primary obligation under the HIPAA Breach Notification Rule?

  1. The incident is not a breach because the recipient confirmed deletion of the PHI.
  2. Notify the affected patient of the breach without unreasonable delay, not to exceed 60 days. (correct answer)
  3. Wait 60 days to see if any harm results from the disclosure before notifying the patient.
  4. Report the incident to the Secretary of HHS immediately due to the electronic nature of the breach.
Explanation: An impermissible disclosure to an unauthorized person is a breach. Even if the recipient states they have deleted the information, the disclosure already occurred. The 'good faith' belief that the PHI was not further used or disclosed can be a mitigating factor in the risk assessment, but it does not eliminate the breach itself. The primary obligation is to notify the affected individual without unreasonable delay, and in no case later than 60 calendar days following the discovery of the breach. Waiting to see if harm results is not compliant. Reporting to HHS is required, but for a breach affecting fewer than 500 individuals, it is done annually, not immediately.

Question 5

At a pharmacy pickup counter, a pharmacist is speaking quietly with a patient about their new diagnosis of hypertension. Another patient, who is waiting in line four feet away, overhears the name of the medical condition. The pharmacy has marked waiting areas on the floor and has a policy for staff to speak in low voices. Which of the following best characterizes this situation?

  1. A reportable breach of PHI, requiring notification to the patient whose information was overheard.
  2. A violation of the 'minimum necessary' standard, requiring disciplinary action against the pharmacist.
  3. An incidental disclosure that does not require breach notification, as reasonable safeguards were in place. (correct answer)
  4. A permitted disclosure for treatment purposes, as it occurred within the pharmacy setting.
Explanation: An incidental use or disclosure is a secondary use or disclosure that cannot reasonably be prevented, is limited in nature, and occurs as a by-product of an otherwise permitted use or disclosure. As long as the covered entity has adopted reasonable safeguards (e.g., speaking quietly, marked waiting lines) and the 'minimum necessary' standard is applied, incidental disclosures are not considered HIPAA violations and do not require breach notification.

Question 6

On August 1, 2024, a pharmacy discovers a breach of PHI affecting 15 individuals that occurred earlier in the year. The pharmacy notifies all affected individuals on September 15, 2024. What is the deadline for this pharmacy to report this breach to the Secretary of Health and Human Services (HHS)?

  1. Within 60 days of the end of the calendar year 2024. (correct answer)
  2. November 14, 2024 (60 days after patient notification).
  3. October 30, 2024 (60 days after discovery).
  4. No report to HHS is required as fewer than 50 individuals were affected.
Explanation: For breaches affecting fewer than 500 individuals, a covered entity must maintain a log or other documentation of the breaches and submit the information to the Secretary of HHS annually. The notification must be submitted no later than 60 days after the end of the calendar year in which the breaches were discovered. In this case, the discovery was in 2024, so the report to HHS is due no later than March 1, 2025 (within 60 days of the end of 2024). The 60-day clock from discovery applies to individual notifications, not the HHS report for small breaches.

Question 7

A pharmacist's laptop containing the PHI of 50 patients is stolen from their locked car. The laptop requires a login password to access the operating system, but the data on the hard drive itself is not encrypted. Which of the following statements accurately describes the pharmacy's responsibility?

  1. This is not a reportable breach because the password protection is a reasonable security measure.
  2. Notification is only required if the pharmacy has evidence that the thief successfully accessed the data.
  3. This is a reportable breach because the PHI was not rendered unusable, unreadable, or indecipherable. (correct answer)
  4. The pharmacy must notify the patients but is exempt from reporting to HHS under the 'theft' exception.
Explanation: Under the HIPAA Breach Notification Rule, a breach of PHI is presumed unless the data is secured. Secured data is defined as data that has been rendered unusable, unreadable, or indecipherable to unauthorized individuals through encryption technology that meets NIST standards. Simple password protection does not meet this 'safe harbor' standard. Therefore, the theft of an unencrypted device containing PHI is a reportable breach. The burden is not on the pharmacy to prove the data was accessed; rather, the impermissible disclosure is presumed. There is no 'theft' exception for reporting to HHS.

Question 8

A pharmacy is preparing a written notification letter to a patient following a breach of their PHI. According to the HIPAA Breach Notification Rule, which of the following elements MUST be included in the letter?

  1. The name of the employee responsible for the breach and the disciplinary action taken.
  2. A statement that the incident has also been reported to the state board of pharmacy.
  3. An offer of complimentary credit monitoring services for at least one year.
  4. A brief description of what the pharmacy is doing to prevent future breaches. (correct answer)
Explanation: The HIPAA Breach Notification Rule specifies the required content for individual notifications. This includes: 1) a brief description of the breach, 2) a description of the types of unsecured PHI involved, 3) steps the individual should take to protect themselves from potential harm, 4) a brief description of what the covered entity is doing to investigate the breach, mitigate harm, and prevent future breaches, and 5) contact procedures for individuals to ask questions. While credit monitoring may be offered, it is not explicitly required by the Rule. Naming the employee and stating other reports made are not required components.

Question 9

A community pharmacy contracts with a document destruction company to dispose of records containing PHI. The pharmacy has a signed Business Associate Agreement (BAA) with the company. The company later informs the pharmacy that one of its employees improperly disposed of a full container of the pharmacy's unshredded records in a public landfill. Who is ultimately responsible for ensuring patients are notified of this breach?

  1. The document destruction company is solely responsible as the breach was caused by its employee.
  2. The pharmacy, as the covered entity, is responsible for ensuring proper breach notification occurs. (correct answer)
  3. Neither party is responsible until there is proof that an unauthorized person has accessed the records.
  4. The BAA transfers all liability for breach notification from the pharmacy to the business associate.
Explanation: While the business associate (the shredding company) has a direct obligation under HIPAA to report the breach to the covered entity (the pharmacy), the covered entity retains ultimate responsibility for ensuring that affected individuals are notified in accordance with the Breach Notification Rule. A BAA outlines the responsibilities of the business associate but does not absolve the covered entity of its duty to ensure patients are properly notified. An impermissible disclosure into a public area is a breach, and waiting for proof of access is not compliant.

Question 10

A pharmacy technician posts on their public social media profile: "Ugh, just spent 20 minutes on the phone with Mr. Smith from Elm Street about his insurance for Ozempic. Some people have all the luck! #pharmacylife". The post does not include the patient's full name or date of birth. Which action is required by the pharmacy?

  1. Treat this as a breach of PHI requiring investigation, mitigation, and notification to the affected patient. (correct answer)
  2. Counsel the technician on social media policy, but no patient notification is needed as the PHI is not directly identifiable.
  3. No action is required as the patient's full name and medical record number were not disclosed.
  4. Report the technician to the State Board of Pharmacy but not to the patient, to avoid causing alarm.
Explanation: Protected Health Information (PHI) includes any information that can be used to identify an individual. The combination of a last name, street name, and specific medication can make the patient reasonably identifiable. This disclosure was not for a permitted purpose and constitutes a breach. The pharmacy must investigate, mitigate the harm (e.g., ensure the post is deleted), take appropriate action against the employee, and notify the affected patient as required by the Breach Notification Rule.