CIPP (US) 5 ā Questions and Answers
Question 1: A healthcare provider wants to use de-identified patient data for research. Under HIPAA's Safe Harbor method of de-identification, how many specific identifiers must be removed?
- 12 identifiers
- 18 identifiers (Correct answer)
- 24 identifiers
- All identifiers except age and gender
Correct answer: 18 identifiers
HIPAA's Safe Harbor method requires removal of 18 specific identifiers, including names, geographic data smaller than a state, dates, and contact information.
Question 2: An organization operating in multiple states must navigate varying state breach notification laws. Which strategy best describes good privacy program practice in this situation?
- Follow the least restrictive state law to reduce compliance burden
- Apply the strictest applicable state standard to all affected individuals (Correct answer)
- Notify only the state where the breach occurred
- Wait for a single federal law before acting
Correct answer: Apply the strictest applicable state standard to all affected individuals
Applying the strictest applicable state standard ensures compliance across all jurisdictions where affected individuals reside.
Question 3: Under GLBA's Safeguards Rule, which element is NOT required in a financial institution's information security program?
- Employee training on security awareness
- Designation of a qualified individual to oversee the program
- Encryption of all customer data at rest (Correct answer)
- Regular testing and monitoring of safeguards
Correct answer: Encryption of all customer data at rest
While encryption is a recommended control, the Safeguards Rule does not mandate encryption of all customer data at rest as an absolute requirement.
Question 4: The concept of 'contextual integrity' in privacy theory holds that information flows appropriately when they:
- Are authorized by an executive officer of the company
- Match the norms of the context in which the information was originally shared (Correct answer)
- Comply with the minimum requirements of applicable law
- Are encrypted during transmission
Correct answer: Match the norms of the context in which the information was originally shared
Contextual integrity, developed by Helen Nissenbaum, holds that privacy is respected when information flows match the norms of the original sharing context.
Question 5: A consumer contacts a credit bureau to dispute an inaccurate item. Under the FCRA, how long does the bureau generally have to investigate the dispute?
- 15 days
- 30 days (Correct answer)
- 45 days
- 60 days
Correct answer: 30 days
The FCRA generally requires consumer reporting agencies to investigate disputes within 30 days (extendable to 45 days in certain circumstances).
Question 6: Which U.S. law specifically restricts financial institutions from sharing nonpublic personal information about consumers with nonaffiliated third parties without offering an opt-out?
- Dodd-Frank Act
- Gramm-Leach-Bliley Act (Correct answer)
- Bank Secrecy Act
- Electronic Funds Transfer Act
Correct answer: Gramm-Leach-Bliley Act
GLBA's Privacy Rule (Regulation P) requires financial institutions to give consumers the right to opt-out before sharing their nonpublic personal information with nonaffiliated third parties.
Question 7: An online behavioral advertising network tracks users across websites without their knowledge. Under current FTC guidance, what is the recommended baseline protection for consumers?
- Mandatory opt-in consent before any tracking
- A browser-based Do Not Track mechanism or similar universal opt-out (Correct answer)
- Disclosure in the website's terms of service is sufficient
- Tracking is permissible if the data is anonymized after 90 days
Correct answer: A browser-based Do Not Track mechanism or similar universal opt-out
The FTC has recommended a universal opt-out mechanism, such as a browser-based Do Not Track signal, as a baseline protection for behavioral tracking.
CIPP (US) 5
A healthcare provider wants to use de-identified patient data for research.
Under HIPAA's Safe Harbor method of de-identification, how many specific identifiers must be removed?