Mixed Deck — All CIPP Topics Flashcards

What are the civil monetary penalty tiers under HIPAA, reflecting the level of culpability?

Answer: Did not know, reasonable cause, willful neglect corrected, willful neglect not corrected — escalating from $100 to $50,000 per violation

HIPAA's tiered civil monetary penalty structure ranges from $100/violation (did not know) to $50,000/violation (willful neglect not corrected), with annual caps per violation category.

Under the Video Privacy Protection Act (VPPA), what is prohibited?

Answer: Disclosing a person's video rental or purchase records without consent

The VPPA prohibits video tape service providers from knowingly disclosing personally identifiable information about consumers' video rental or purchase records without consent.

Under FERPA, when does a student's (not parent's) right to control education records begin?

Answer: When the student turns 18 or attends a postsecondary institution

FERPA rights transfer from parents to the student (who becomes an 'eligible student') when the student turns 18 or enrolls in a postsecondary school, whichever comes first.

What FCRA requirement must employers fulfill BEFORE taking adverse action based on a background check report?

Answer: Provide the applicant with a copy of the report and a pre-adverse action notice

FCRA requires employers to provide applicants with a copy of the consumer report and a pre-adverse action notice giving them opportunity to dispute inaccuracies before taking adverse action.

What must an employer's acceptable use policy for workplace technology typically address to protect against employee privacy claims?

Answer: Notice that monitoring may occur and there is no expectation of privacy on employer systems

Clearly communicating that there is no expectation of privacy on employer systems reduces employee privacy claims and establishes the employer's right to monitor.

The Fair and Accurate Credit Transactions Act (FACTA) most significantly amended FCRA by establishing:

Answer: The right to one free credit report per year from each major consumer reporting agency

FACTA created the right for consumers to obtain one free credit report annually from each of the three major CRAs — Equifax, Experian, and TransUnion — through AnnualCreditReport.com.

Under the Privacy Act of 1974, federal agency employees have the right to:

Answer: Access and correct their records held in agency systems of records

The Privacy Act gives federal employees the right to access and request correction of records about themselves maintained in federal agency systems of records.

Which federal law specifically regulates the privacy of cable television subscribers' personal information?

Answer: Cable Communications Policy Act of 1984

The Cable Communications Policy Act requires cable operators to protect subscriber personal information and provide annual notice of privacy practices.

What federal law generally applies to privacy of employee medical information obtained through employer wellness programs?

Answer: ADA and GINA apply; HIPAA applies only if the plan is a group health plan

ADA limits employer use of medical information from wellness programs; GINA restricts genetic information; HIPAA applies if the employer's group health plan is involved.

FACTA's 'Red Flags Rule' requires covered entities to:

Answer: Develop and implement written programs to detect and respond to identity theft red flags

The Red Flags Rule mandates that financial institutions and creditors establish written identity theft prevention programs that identify warning signs (red flags) and prescribe responses.

What is the 'right to be forgotten' equivalent in the US context, and how does it compare to GDPR?

Answer: Limited state-law deletion rights (e.g., CCPA) that are narrower than GDPR's broad right to erasure

The US lacks a comprehensive federal right to erasure; state laws like CCPA provide deletion rights but with more exceptions and narrower scope than GDPR's Article 17.

Which US state law requires notification to the state attorney general before or simultaneously with notifying consumers?

Answer: New York SHIELD Act

New York's SHIELD Act requires businesses to notify the NY Attorney General, the Department of State, and other agencies concurrently with consumer notifications.

Under the HIPAA Privacy Rule, which government entity receives patient complaints about HIPAA violations?

Answer: HHS Office for Civil Rights (OCR)

The HHS Office for Civil Rights (OCR) is the primary enforcement agency for HIPAA Privacy and Security Rule complaints and violations.

The GLBA Safeguards Rule primarily requires financial institutions to:

Answer: Develop, implement, and maintain a comprehensive information security program

The Safeguards Rule mandates that financial institutions establish and maintain a written comprehensive information security program appropriate to the size and complexity of the institution.

Which federal law protects the privacy of students' education records at schools receiving federal funding?

Answer: Family Educational Rights and Privacy Act (FERPA)

FERPA protects the privacy of student education records at schools receiving federal education funding, giving parents and eligible students rights to access and control disclosure.

Which US federal agency serves as the primary enforcer of financial institution data breach obligations under the GLBA Safeguards Rule?

Answer: FTC (for non-bank financial institutions)

The FTC enforces the GLBA Safeguards Rule for non-bank financial institutions, while banking regulators enforce it for banks.

Which privacy concern arises when employers use social media screening of job applicants?

Answer: Exposure to legally protected characteristics not visible during the interview process

Social media profiles often reveal protected characteristics like religion, race, age, or disability, creating potential discrimination liability if this information influences hiring decisions.

The FTC's enforcement authority over privacy primarily derives from which legal provision?

Answer: Section 5 of the FTC Act prohibiting unfair or deceptive acts

The FTC uses Section 5 of the FTC Act, which prohibits unfair or deceptive practices, as its primary tool to enforce privacy commitments.

Under the HIPAA Breach Notification Rule, large breaches affecting 500 or more individuals must be reported to HHS within what timeframe?

Answer: 60 days of discovery

Covered entities must notify HHS of breaches affecting 500 or more residents of a state or jurisdiction within 60 days of discovery.

Which US law regulates the privacy of electronic communications made by pen register or trap-and-trace devices?

Answer: Pen Register Act (Title III of ECPA)

The Pen Register Act (Title III of ECPA) requires court orders before government use of pen registers (recording numbers dialed) or trap-and-trace devices (recording incoming numbers).