C used. should be encrypted to protect the privacy and security of patient information covered entity, business associate, or subcontractor commits a breach, it must fl HIPAA breach notification requirements. CHECK YOUR UNDERSTANDING 5.2 Instructions: Indicate whether the following statements are true or false (T or F 1. A disaster recovery plan restores critical services as quickly as possible 2. An emergency mode of operations includes identifying the minimum 3. Data recovery should not include obtaining copies of records from entites 4. Health information exchange (HlE) opt-out models are prohibited by the 5. A patient portal is often hosted and controlled by a provider or payer after an event. number of people needed to complete each function. that received records from the organization. HIPAA Security Rule REAL-WORLD CASE