Mixed Deck — All CIPP/US Topics Flashcards

Why is confidentiality important in professional practice?

Answer: It protects sensitive information and maintains trust between professionals and clients

Confidentiality is essential because it protects sensitive information entrusted to professionals and maintains the trust necessary for effective professional relationships.

Under the FCRA, how long before taking adverse employment action must an employer wait after providing the pre-adverse action notice?

Answer: A reasonable period of time (generally interpreted as at least 5 business days)

FCRA requires a 'reasonable period of time' between the pre-adverse action notice and final adverse action, which the FTC has interpreted as approximately five business days.

The Electronic Communications Privacy Act (ECPA) primarily regulates which of the following?

Answer: Interception of wire, oral, and electronic communications

ECPA regulates government and private interception of wire, oral, and electronic communications, as well as access to stored electronic communications.

Which concept requires minimizing the collection of personal data?

Answer: Data minimization

Data minimization is a core privacy principle that dictates organizations should only collect, process, and store the minimum amount of personal data necessary to achieve a specified purpose. This practice reduces the risk of data breaches and misuse, enhances privacy by design, and helps organizations comply with regulations like GDPR and CCPA.

What is the primary goal of quality assurance in professional practice?

Answer: To ensure consistent delivery of products or services that meet established standards

Quality assurance focuses on ensuring that products, services, and processes consistently meet or exceed established standards and stakeholder expectations.

When should established methodologies be reconsidered?

Answer: When evidence shows better alternatives exist or when outcomes decline

Established methodologies should be reconsidered when new evidence suggests better alternatives, when outcomes decline, or when the operating context changes significantly.

The HIPAA Privacy Rule's 'minimum necessary' standard requires covered entities to:

Answer: Limit PHI uses and disclosures to the minimum necessary to accomplish the intended purpose

The minimum necessary standard requires covered entities to make reasonable efforts to limit PHI access and disclosure to only what is needed for the specific purpose.

Which foundational principle is most critical to professional practice in this field?

Answer: Evidence-based decision making and continuous improvement

Evidence-based decision making ensures that professional practices are grounded in proven methodologies and current best practices.

The FTC Act's authority to regulate health data practices applies in which of the following circumstances?

Answer: To companies not covered by HIPAA that collect health-related information, under the prohibition on unfair or deceptive practices

The FTC uses Section 5 of the FTC Act to regulate health data privacy for entities outside HIPAA's scope, such as fitness apps and direct-to-consumer health platforms.

Under the Computer Fraud and Abuse Act (CFAA), unauthorized access to a protected computer system is classified as:

Answer: A federal crime subject to criminal and civil liability

The CFAA makes unauthorized access to protected computers a federal crime and also provides a civil cause of action for victims.

What is the consequence of non-compliance with mandatory regulations?

Answer: Penalties including fines, license revocation, and potential legal action

Non-compliance with mandatory regulations can result in serious consequences including financial penalties, loss of licensure, and legal proceedings.

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to provide customers with privacy notices and:

Answer: Implement a comprehensive information security program to safeguard customer financial information

The GLBA requires financial institutions to provide privacy notices and, under the Safeguards Rule, to develop and maintain a comprehensive written information security program.

Under HIPAA, how must an employer handle employee health information obtained through a self-insured health plan?

Answer: It must be kept separate from other personnel records and accessed only by those who need it to administer the plan

HIPAA requires employers who sponsor self-insured health plans to maintain health information separately and limit access to plan administration personnel only.

Which U.S. law governs the privacy of children's personal information online?

Answer: COPPA

The Children's Online Privacy Protection Act (COPPA) is a landmark U.S. federal law specifically designed to protect the privacy of children under 13 online. It mandates that websites and online services obtain verifiable parental consent before collecting, using, or disclosing personal information from children. COPPA sets strict requirements for operators regarding data collection practices, parental notification, and data security for children's data.

Which federal agency enforces the Children's Online Privacy Protection Act (COPPA)?

Answer: Federal Trade Commission

The Children's Online Privacy Protection Act (COPPA) is a U.S. federal law designed to protect the online privacy of children under 13. The Federal Trade Commission (FTC) is the primary agency responsible for enforcing COPPA, issuing rules and taking enforcement actions against companies that violate its provisions regarding the collection of personal information from children.

What type of action can the FTC take against companies violating privacy laws?

Answer: File civil enforcement actions

The Federal Trade Commission (FTC) has significant enforcement powers to address violations of privacy laws and unfair or deceptive trade practices. These powers include filing civil enforcement actions in federal court, negotiating consent decrees with companies, and imposing monetary penalties or requiring specific remedial actions to protect consumers.

A company implements keystroke logging software on all employee computers. What is the most important step the company should take to limit privacy risk?

Answer: Provide clear notice to employees through an acceptable use policy

Providing clear notice through an acceptable use or monitoring policy reduces privacy risk and supports the business extension exception under ECPA.

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals of a breach of unsecured PHI within:

Answer: 60 days of discovery

The HIPAA Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and no later than 60 days after discovery of the breach.

Under the Video Privacy Protection Act (VPPA), a video service provider generally cannot disclose a consumer's video rental or viewing history without:

Answer: The consumer's informed, written consent or a court order

The VPPA prohibits video tape service providers from disclosing personally identifiable information about rental or purchase records without the consumer's informed written consent or a court order.

When applying core principles in practice, what should be the first consideration?

Answer: Safety and compliance with established standards

Safety and compliance with established standards must always be the primary consideration when applying professional principles.