hardMultiple ChoiceObjective-mapped
CCSP Practice Question: A healthcare company uses a cloud-based patient…
A healthcare company uses a cloud-based patient management system. The cloud provider experiences a security incident that may have exposed protected health information (PHI). The provider notifies the company within 72 hours, as required by the service agreement. The company's internal breach response policy requires a legal review of the incident before notifying affected individuals. The legal review typically takes 48 hours. However, the company is required to notify patients within 60 days under HIPAA. With the 72-hour notification from the provider, the company has 60 days to notify patients. What is the most effective approach to meet the 60-day notification requirement while ensuring compliance with internal policy?
⚠ Common exam trap
ISC2 often tests the misconception that you must choose between compliance and internal policy, when in fact parallel processing of legal review and notification preparation is the correct approach to meet both requirements without violating the 60-day HIPAA deadline.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Begin the legal review immediately and prepare patient notification in parallel.
It allows the company to satisfy both the HIPAA 60-day notification requirement and its internal legal review policy by running the legal review and patient notification preparation concurrently. This parallel approach minimizes delay while ensuring that the notification content is legally vetted before release, which is critical for PHI incidents under HIPAA's Breach Notification Rule (45 CFR § 164.404).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Notify patients immediately and then perform the legal review.
Why it's wrong here
Notifying before legal review could result in needing to correct or retract statements.
- ✗
Wait for the legal review to complete before notifying patients.
Why it's wrong here
If legal review takes 48 hours, there is still plenty of time, but this is less efficient and may delay other steps.
- ✗
Notify patients immediately based on the provider's notification.
Why it's wrong here
Skipping legal review may lead to premature or inaccurate notifications.
- ✓
Begin the legal review immediately and prepare patient notification in parallel.
Why this is correct
Parallel processing allows timely notification while ensuring legal input is incorporated.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.