CIPP/US Workplace Privacy & Employee Monitoring 3

Question 1

Under HIPAA, how must an employer handle employee health information obtained through a self-insured health plan?

Accepted Answer

It must be kept separate from other personnel records and accessed only by those who need it to administer the plan

Answer

It may be freely shared with supervisors for accommodation purposes

Answer

It is exempt from HIPAA because employment records are excluded

Answer

It must be destroyed within 60 days of receipt

Question 2

An employee notifies their manager of a disability and requests a reasonable accommodation. Under the ADA, the employer's privacy obligation regarding this disclosure is to:

Accepted Answer

Keep the medical information confidential and share it only with those who have a specific need to know on a need-to-know basis

Answer

File it with the EEOC within 30 days

Answer

Disclose it to HR and the employee's entire team to facilitate the accommodation

Answer

Retain it in the general personnel file for documentation purposes

Question 3

Which of the following is the best practice when an employer wants to implement video surveillance of the workplace?

Accepted Answer

Provide employees with advance notice of the surveillance through a written policy, avoiding placement in areas where employees have a heightened expectation of privacy such as restrooms

Answer

Install cameras in all areas including restrooms to deter theft

Answer

Obtain signed waivers from each employee consenting to 24-hour surveillance

Answer

Notify only senior management and security personnel to preserve the deterrent effect

Question 4

What is the primary purpose of an employee privacy notice under the California Consumer Privacy Act (CCPA) as amended by the CPRA?

Accepted Answer

To inform employees about the categories of personal information collected about them and the purposes for which it is used

Answer

To obtain employee consent before collecting any personal data

Answer

To comply with HIPAA's notice of privacy practices requirement

Answer

To satisfy FCRA's pre-adverse action disclosure obligations

Question 5

An employer conducts an internal investigation of an employee suspected of misconduct. From a workplace privacy perspective, which approach best balances employer and employee interests?

Accepted Answer

Limiting the investigation to relevant evidence, informing only those with a need to know, and documenting the process to demonstrate proportionality

Answer

Conducting a broad investigation of all employee communications to ensure thoroughness

Answer

Publicizing the investigation to deter future misconduct by other employees

Answer

Delegating the investigation entirely to law enforcement to avoid privacy liability

Question 6

Under the Stored Communications Act (SCA), which of the following employer actions would most likely be permissible?

Accepted Answer

Accessing emails stored on the company's own email server without employee consent

Answer

Accessing an employee's personal Gmail account without consent

Answer

Intercepting employee messages on a third-party messaging platform in real time

Answer

Compelling a third-party cloud provider to disclose employee personal communications without legal process

Question 7

A multistate employer must navigate varying state workplace privacy laws. Which of the following is the most prudent compliance strategy?

Accepted Answer

Adopt the most protective state standard as the baseline policy while documenting state-specific variations where required

Answer

Apply only federal law uniformly across all states to ensure consistency

Answer

Create entirely separate HR policies for every state with no cross-reference

Answer

Comply only with the state where the corporate headquarters is located