CIPT Privacy Program Implementation and Operations 2

Question 1

Under the US HIPAA Breach Notification Rule, how quickly must covered entities notify affected individuals of an unsecured PHI breach?

Accepted Answer

Without unreasonable delay and no later than 60 days after discovery

Answer

Within 24 hours of discovery

Answer

Within 14 days of discovery

Answer

Only after completing a full forensic investigation, with no time limit

Question 2

Which US state law, effective January 2020, grants California consumers the right to know what personal information is collected about them and to request its deletion?

Accepted Answer

California Consumer Privacy Act (CCPA)

Answer

California Online Privacy Protection Act (CalOPPA)

Answer

California Privacy Rights Act (CPRA)

Answer

California Data Breach Notification Law (SB-1386)

Question 3

What does a 'privacy program gap analysis' involve?

Accepted Answer

Comparing the current state of privacy practices against a target framework to identify deficiencies

Answer

Analyzing gaps in network firewall rules

Answer

Measuring the difference between budgeted and actual privacy costs

Answer

Reviewing employee performance reviews for privacy policy violations

Question 4

Which operational practice ensures that privacy controls remain effective as systems, regulations, and threats evolve over time?

Accepted Answer

Continuous monitoring and periodic privacy program reviews

Answer

A one-time compliance audit at program launch

Answer

Annual policy republication without control testing

Answer

Delegating all privacy decisions to legal counsel

Question 5

A privacy team implements a process to handle user requests to access, correct, or delete their personal data. What is this process called?

Accepted Answer

Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process

Answer

Privacy impact assessment workflow

Answer

Breach notification procedure

Answer

Vendor onboarding checklist

Question 6

Which element of a privacy program ensures employees know how to recognize and escalate a potential personal data breach?

Accepted Answer

Privacy incident reporting channel and training on what constitutes a reportable event

Answer

Automated data loss prevention (DLP) only

Answer

Annual password rotation policy

Answer

Network segmentation controls