CGRC CGRC Privacy and Data Protection 2

Question 1

Which federal law requires healthcare organizations to protect the privacy of patients' health information and is frequently referenced in CGRC study materials?

Accepted Answer

HIPAA

Answer

HIPAA's Privacy Rule and Security Rule establish national standards for protecting individually identifiable health information held by covered entities.

Question 2

What is a Privacy Continuous Monitoring (PCM) program designed to do?

Accepted Answer

Provide ongoing awareness of privacy risks and control effectiveness across the system lifecycle

Answer

Privacy Continuous Monitoring provides real-time or near-real-time visibility into privacy controls, enabling organizations to detect and respond to privacy risks as they evolve.

Question 3

Which role is responsible for ensuring that privacy requirements are integrated into the organization's programs and that privacy risks are managed?

Accepted Answer

Chief Privacy Officer (CPO) / Senior Agency Official for Privacy (SAOP)

Answer

The Senior Agency Official for Privacy (SAOP) is responsible for agency-wide privacy policy, compliance, and risk management under the Privacy Act and E-Government Act.

Question 4

Under NIST SP 800-122, what is the recommended approach for assessing privacy risk associated with PII?

Accepted Answer

Evaluate the likelihood of a PII breach and the impact on affected individuals

Answer

NIST SP 800-122 recommends assessing PII confidentiality risk by evaluating both the likelihood of a breach and the potential harm to affected individuals.

Question 5

What is the purpose of a data retention schedule in a privacy program?

Accepted Answer

To specify how long PII and other records must be kept before secure disposal

Answer

A data retention schedule establishes how long each type of record, including PII, must be retained to meet legal requirements and when it must be securely destroyed.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC CGRC Privacy and Data Protection 2