CIPP (US) 5

Question 1

A healthcare provider wants to use de-identified patient data for research. Under HIPAA's Safe Harbor method of de-identification, how many specific identifiers must be removed?

Accepted Answer

18 identifiers

Answer

HIPAA's Safe Harbor method requires removal of 18 specific identifiers, including names, geographic data smaller than a state, dates, and contact information.

Question 2

An organization operating in multiple states must navigate varying state breach notification laws. Which strategy best describes good privacy program practice in this situation?

Accepted Answer

Apply the strictest applicable state standard to all affected individuals

Answer

Applying the strictest applicable state standard ensures compliance across all jurisdictions where affected individuals reside.

Question 3

Under GLBA's Safeguards Rule, which element is NOT required in a financial institution's information security program?

Accepted Answer

Encryption of all customer data at rest

Answer

While encryption is a recommended control, the Safeguards Rule does not mandate encryption of all customer data at rest as an absolute requirement.

Question 4

The concept of 'contextual integrity' in privacy theory holds that information flows appropriately when they:

Accepted Answer

Match the norms of the context in which the information was originally shared

Answer

Contextual integrity, developed by Helen Nissenbaum, holds that privacy is respected when information flows match the norms of the original sharing context.

Question 5

A consumer contacts a credit bureau to dispute an inaccurate item. Under the FCRA, how long does the bureau generally have to investigate the dispute?

Accepted Answer

30 days

Answer

The FCRA generally requires consumer reporting agencies to investigate disputes within 30 days (extendable to 45 days in certain circumstances).

Certified Information Privacy Professional Practice Test

Certified Information Privacy Professional Practice Test

CIPP (US) 5