CIPP IAPP 3

Question 1

A data breach at a HIPAA-covered entity affects 600 individuals. What is the required notification timeline to HHS?

Accepted Answer

Within 60 days of discovery

Answer

For breaches affecting fewer than 500 individuals, HIPAA requires notification to HHS within 60 days of the end of the calendar year, but for 500+ it's 60 days of discovery; however the general rule for all is within 60 days of discovery.

Question 2

Which enforcement mechanism allows the FTC to take action against unfair or deceptive privacy practices?

Accepted Answer

Section 5 of the FTC Act prohibiting unfair or deceptive acts or practices

Answer

Section 5 of the FTC Act is the primary enforcement tool that prohibits unfair or deceptive acts or practices, enabling the FTC to act against companies that fail to follow their privacy promises.

Question 3

Under the EU-US Data Privacy Framework (DPF), a US organization that self-certifies must do which of the following?

Accepted Answer

Annually re-certify with the US Department of Commerce

Answer

Organizations self-certifying under the DPF must annually re-certify their compliance with the framework's principles through the US Department of Commerce.

Question 4

The concept of 'privacy by design' in US practice most closely aligns with which NIST Privacy Framework function?

Accepted Answer

Protect-P

Answer

The Protect-P function in the NIST Privacy Framework covers developing and implementing data processing safeguards, which aligns with embedding privacy into system and product design.

Question 5

Under the CAN-SPAM Act, commercial email senders must:

Accepted Answer

Honor opt-out requests within 10 business days and include a physical postal address

Answer

CAN-SPAM requires commercial email senders to honor unsubscribe requests within 10 business days and include a valid physical postal address in every message.

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

CIPP IAPP 3