CGRC Privacy and Data Protection Flashcards

Which federal law requires healthcare organizations to protect the privacy of patients' health information and is frequently referenced in CGRC study materials?

Answer: HIPAA

HIPAA's Privacy Rule and Security Rule establish national standards for protecting individually identifiable health information held by covered entities.

What is a Privacy Continuous Monitoring (PCM) program designed to do?

Answer: Provide ongoing awareness of privacy risks and control effectiveness across the system lifecycle

Privacy Continuous Monitoring provides real-time or near-real-time visibility into privacy controls, enabling organizations to detect and respond to privacy risks as they evolve.

Which role is responsible for ensuring that privacy requirements are integrated into the organization's programs and that privacy risks are managed?

Answer: Chief Privacy Officer (CPO) / Senior Agency Official for Privacy (SAOP)

The Senior Agency Official for Privacy (SAOP) is responsible for agency-wide privacy policy, compliance, and risk management under the Privacy Act and E-Government Act.

Under NIST SP 800-122, what is the recommended approach for assessing privacy risk associated with PII?

Answer: Evaluate the likelihood of a PII breach and the impact on affected individuals

NIST SP 800-122 recommends assessing PII confidentiality risk by evaluating both the likelihood of a breach and the potential harm to affected individuals.

What is the purpose of a data retention schedule in a privacy program?

Answer: To specify how long PII and other records must be kept before secure disposal

A data retention schedule establishes how long each type of record, including PII, must be retained to meet legal requirements and when it must be securely destroyed.

Which technique renders PII useless to unauthorized parties if a breach occurs while still allowing data to be used for its intended purpose?

Answer: Data masking / de-identification

De-identification and masking techniques remove or obscure direct and indirect identifiers so that data cannot reasonably be linked back to a specific individual.