CIPA Data Security & Privacy Compliance 5

Question 1

A healthcare organization wants to share patient data with researchers while removing all 18 HIPAA identifiers. This process is formally called:

Accepted Answer

De-identification

Answer

HIPAA's Safe Harbor and Expert Determination methods describe de-identification as the removal of the 18 specified identifiers so data is no longer considered PHI.

Question 2

Under the NIST Cybersecurity Framework, which function focuses on developing and implementing activities to identify the occurrence of a cybersecurity event?

Accepted Answer

Detect

Answer

The 'Detect' function of the NIST CSF encompasses continuous monitoring and anomaly detection to discover cybersecurity events in a timely manner.

Question 3

A company's privacy policy states it will only use email addresses for order confirmations but then uses them for promotional campaigns. This violates which key privacy principle?

Accepted Answer

Purpose limitation

Answer

Purpose limitation requires that personal data collected for one specific purpose not be used for a different, incompatible purpose without additional consent.

Question 4

An identity thief uses stolen credentials to access multiple accounts by testing username/password pairs obtained from other data breaches. This attack is called:

Accepted Answer

Credential stuffing

Answer

Credential stuffing automates the testing of stolen username/password combinations from one breach against other websites, exploiting password reuse.

Question 5

Which US law specifically regulates the accuracy, fairness, and privacy of information in consumer credit reporting files?

Accepted Answer

FCRA

Answer

The Fair Credit Reporting Act (FCRA) governs the collection, dissemination, and use of consumer credit information, including consumer rights to dispute inaccuracies.

(CIPA) Certified Identity Protection Advisor Practice Test

(CIPA) Certified Identity Protection Advisor Practice Test

CIPA Data Security & Privacy Compliance 5