# A nurse manager discovers that a hospital-issued laptop containing the protected health information (PHI) of 850 clients was stolen from an employee vehicle 8 days ago. The laptop was encrypted, but the encryption certificate was on a sticky note attached to the device. Which actions are required under the HIPAA Breach Notification Rule? Select all that apply.

> source: MyMerci (mymerci.kr)  
> url: https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=en  
> language: en  
> subject: Confidentiality/Information Security  
> category: MOC

## Question

A nurse manager discovers that a hospital-issued laptop containing the protected health information (PHI) of 850 clients was stolen from an employee vehicle 8 days ago. The laptop was encrypted, but the encryption certificate was on a sticky note attached to the device. Which actions are required under the HIPAA Breach Notification Rule? Select all that apply.

1

Notify prominent media outlets serving the state or jurisdiction because more than 500 individuals are affected

2

Report the breach to the U.S. Department of Health and Human Services because more than 500 individuals are affected

3

For the 15 people with insufficient contact information, post a conspicuous website notice for 90 days or use major media and provide a toll-free number active for 90 days

4

Document the four-factor risk assessment used to determine that compromise of PHI is presumed under the breach rule

5

Notify each affected individual in writing within 60 calendar days of breach discovery

6

Delay notification until the next quarterly compliance committee meeting to consolidate breach reports

## Explanation

The HIPAA Breach Notification Rule applies because the attached encryption key makes the PHI readable and the incident affects 850 individuals. Option 1 is correct: a breach affecting more than 500 residents of a state or jurisdiction requires notice to prominent local media. Option 2 is correct: the Secretary of HHS must be notified without unreasonable delay and no later than 60 days. Option 3 is correct: because contact information is insufficient for 15 people, substitute notice must be posted conspicuously on the website for at least 90 days or placed in major print or broadcast media, with a toll-free number active for at least 90 days. Option 4 is correct: the entity must document its breach determination and the four-factor risk assessment concerning the probability that PHI was compromised. Option 5 is correct: affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. Option 6 is incorrect because waiting for a quarterly meeting could violate the notification deadline.

## In-depth explanation

HIPAA Breach Notification — When Greater Than 500
60-day deadline + individual notice + HHS report + media notice + 90-day contact line. All are simultaneously required.

Encryption Safe Harbor
Encrypted PHI is generally not a reportable breach — but here the encryption certificate was physically with the device, so the safe harbor is lost and compromise is presumed.

Four-Factor Risk Assessment
1. Nature and extent of PHI
2. Who used or received it
3. Was it actually acquired or viewed
4. Mitigation steps

Wrong Answer
5: Quarterly meeting delay violates the 60-day statutory deadline.

NCSBN Theme
MOC — Confidentiality / Information Technology / Legal Responsibilities.

## Clinical scenario

Scenario
Hospital laptop stolen from an employee vehicle 8 days ago.

Scope
- 850 individuals with PHI on the laptop
- Contact information is insufficient or out of date for 15 affected individuals
- Device was encrypted, but the encryption certificate was attached to it

Status
- Within the 60-day notification window
- Encryption safe harbor does not apply because the key was attached

Trigger
At least 500 affected individuals requires individual, HHS, and media notification; missing contact information for at least 10 also triggers substitute notice.

## Key concepts

- **HIPAA Breach Notification Rule** — 45 CFR Part 164 Subpart D — the federal rule requiring covered entities and business associates to notify affected individuals, HHS, and (when greater than 500 in a state or jurisdiction) the media within specific timelines. Standard timeline: 60 calendar days from discovery for individual notice. Smaller breaches go on the annual log.
- **Encryption safe harbor** — Under HIPAA, properly encrypted PHI rendered unusable, unreadable, or indecipherable to unauthorized persons is generally not a breach. Safe harbor is lost when the encryption key is co-located with the encrypted device (sticky note, file stored on the device, default password unchanged).
- **Four-factor risk assessment** — Required documentation when compromise of PHI is uncertain: (1) nature and extent of PHI involved (sensitivity), (2) unauthorized person who used or received PHI, (3) whether PHI was actually acquired or viewed, (4) mitigation efforts. Compromise is presumed unless the four factors demonstrate low probability of compromise.

## Related questions

- [A nurse reviews several scenarios involving client information. Which scenarios represent …](https://mymerci.kr/pages/nclex_q.php?qn_id=363986&lang=en)
- [A nurse discovers that a discharge summary containing protected health information was fax…](https://mymerci.kr/pages/nclex_q.php?qn_id=393393&lang=en)
- [The charge nurse reviews eight uses or disclosures of protected health information. Drag e…](https://mymerci.kr/pages/nclex_q.php?qn_id=396455&lang=en)
- [Review the timeline after protected health information is sent to the wrong recipient and …](https://mymerci.kr/pages/nclex_q.php?qn_id=535414&lang=en)
- [Review the timeline after protected health information is sent to the wrong recipient and …](https://mymerci.kr/pages/nclex_q.php?qn_id=568927&lang=en)

## Read in another language

- [en](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=en)
- [ko](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=ko)
- [ja](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=ja)
- [zh-TW](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=zh-tw)
- [vi](https://mymerci.kr/pages/nclex_q.php?qn_id=368101&lang=vi)

---

More free questions: [NCLEX-RN Practice](https://mymerci.kr/pages/nclex_bank.php?lang=en)

_For study reference only. Always follow current clinical guidelines and your institution’s protocols._