In the event of a patient data privacy breach, which obligation is typically triggered?

• A. Breach notices to patients and authorities are required; penalties may apply; prompt containment and remediation.
• B. Notifications to patients only are required, with no penalties.
• C. No penalties for breaches; remedial actions are internal.
• D. Breach notices to patients and authorities are required; penalties may apply; prompt containment and remediation.

Answer: (D)

When a patient data privacy breach occurs, the obligation is to notify both the affected individuals and the appropriate authorities or regulators, with penalties possible for non-compliance, and to act quickly to contain and remediate the breach. This combination reflects the protective purpose of privacy laws: alert those at risk so they can take steps to mitigate harm, involve the oversight bodies that enforce standards, and provide consequences to encourage accountability. Prompt containment and remediation are essential parts of the duty, showing a responsible response to minimize damage and prevent recurrence. The other options miss key elements—one omits regulator notification, another denies penalties, and another limits action to internal steps without external reporting.