CACs Privacy and Security Standards 2

Question 1

A consumer asks their CAC to email a copy of their completed Marketplace application to a family member. What is the correct response?

Accepted Answer

Decline unless the consumer provides written authorization and the family member is an authorized representative

Answer

Send the email immediately as requested by the consumer

Answer

Forward the application only if the family member is listed as a dependent

Answer

Send a password-protected copy to the family member's email

Question 2

Which federal law primarily governs the privacy protections that CACs must follow when handling consumers' health information?

Accepted Answer

The Health Insurance Portability and Accountability Act (HIPAA)

Answer

The Privacy Act of 1974

Answer

The Fair Credit Reporting Act (FCRA)

Answer

The Affordable Care Act (ACA) Privacy Rule

Question 3

A CAC discovers that a co-worker has been accessing consumer application files without a business need. What should the CAC do first?

Accepted Answer

Report the incident to their supervisor or privacy officer immediately

Answer

Confront the co-worker directly and ask them to stop

Answer

Notify the affected consumers before taking any other action

Answer

Document the access and wait to see if it continues

Question 4

When a consumer calls a CAC's office and wants to discuss their application over the phone, what should the CAC do first?

Accepted Answer

Verify the caller's identity using established authentication questions before discussing any PII

Answer

Proceed with the conversation since the consumer initiated the call

Answer

Ask the caller to come in person since phone discussions are prohibited

Answer

Request the consumer's Marketplace username and password to confirm identity

Question 5

A CAC prints a consumer's application summary and accidentally leaves it on a shared printer. This is an example of what type of privacy risk?

Accepted Answer

An inadvertent disclosure of PII

Answer

A phishing incident

Answer

A HIPAA security rule violation only

Answer

An authorized use of consumer data

Question 6

Under Marketplace privacy rules, for how long are CAC organizations generally required to retain records of their consumer assistance activities?

Accepted Answer

5 years

Answer

1 year

Answer

3 years

Answer

10 years

Question 7

A consumer provides their Social Security Number during an enrollment session. How should a CAC handle this information after the session ends?

Accepted Answer

Ensure it is stored only in approved, secured systems and any physical notes are shredded

Answer

Keep a personal copy for follow-up purposes

Answer

Store it in any convenient location as long as it's at the workplace

Answer

Share it with the Navigator network for coordination purposes