Certified Information Privacy Professional Data Breach Notification Laws

Question 1

Which US federal law requires covered entities to notify individuals of breaches involving unsecured protected health information?

Accepted Answer

HITECH Act

Answer

COPPA

Answer

GLBA

Answer

FERPA

Question 2

Under most US state breach notification laws, what triggers the notification obligation?

Accepted Answer

Unauthorized acquisition of personal information

Answer

Any access to a database

Answer

Loss of encrypted data

Answer

Internal employee data sharing

Question 3

Which state enacted the first US data breach notification law in 2003?

Accepted Answer

California

Answer

New York

Answer

Texas

Answer

Florida

Question 4

The SEC requires publicly traded companies to disclose material cybersecurity incidents within how many business days?

Accepted Answer

4 business days

Answer

10 business days

Answer

30 calendar days

Answer

72 hours

Question 5

Which element is commonly required in a breach notification letter to consumers?

Accepted Answer

Description of the type of information involved

Answer

The company's annual revenue

Answer

Names of all employees who had access

Answer

The attacker's identity

Question 6

Under the HIPAA Breach Notification Rule, large breaches affecting 500 or more individuals must be reported to HHS within what timeframe?

Accepted Answer

60 days of discovery

Answer

30 days of discovery

Answer

72 hours of discovery

Answer

1 year of discovery