Certified Information Privacy Professional Data Breach Notification Laws

Question 1

Which US federal law requires covered entities to notify individuals of breaches involving unsecured protected health information?

Accepted Answer

HITECH Act

Answer

The HITECH Act established the HIPAA Breach Notification Rule requiring covered entities to notify affected individuals, HHS, and sometimes the media of PHI breaches.

Question 2

Under most US state breach notification laws, what triggers the notification obligation?

Accepted Answer

Unauthorized acquisition of personal information

Answer

Notification is typically triggered when personal information is acquired by an unauthorized person, not merely accessed or viewed.

Question 3

Which state enacted the first US data breach notification law in 2003?

Accepted Answer

California

Answer

California's SB 1386, effective in 2003, was the first state data breach notification law and served as a model for other states.

Question 4

The SEC requires publicly traded companies to disclose material cybersecurity incidents within how many business days?

Accepted Answer

4 business days

Answer

The SEC's 2023 cybersecurity rules require public companies to file Form 8-K disclosing material incidents within four business days of determining materiality.

Question 5

Which element is commonly required in a breach notification letter to consumers?

Accepted Answer

Description of the type of information involved

Answer

State breach notification laws typically require the letter to describe the type of personal information that was involved in the breach.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Data Breach Notification Laws