Privacy Program Implementation and Operations Flashcards

Under the US HIPAA Breach Notification Rule, how quickly must covered entities notify affected individuals of an unsecured PHI breach?

Answer: Without unreasonable delay and no later than 60 days after discovery

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals without unreasonable delay and within 60 days of discovering a breach of unsecured PHI.

Which US state law, effective January 2020, grants California consumers the right to know what personal information is collected about them and to request its deletion?

Answer: California Consumer Privacy Act (CCPA)

The CCPA, effective January 1, 2020, established rights for California consumers including access, deletion, and opt-out of sale of personal information.

What does a 'privacy program gap analysis' involve?

Answer: Comparing the current state of privacy practices against a target framework to identify deficiencies

A gap analysis maps existing privacy controls against a regulatory framework or best-practice standard to identify where the program falls short and prioritize remediation.

Which operational practice ensures that privacy controls remain effective as systems, regulations, and threats evolve over time?

Answer: Continuous monitoring and periodic privacy program reviews

Continuous monitoring detects control failures and changing risk conditions, while periodic reviews reassess whether the program still meets current regulatory and business requirements.

A privacy team implements a process to handle user requests to access, correct, or delete their personal data. What is this process called?

Answer: Data Subject Rights (DSR) or Data Subject Access Request (DSAR) fulfillment process

A DSAR fulfillment process includes identity verification, data location, compilation, review, and timely response to requests from data subjects exercising their legal rights.

Which element of a privacy program ensures employees know how to recognize and escalate a potential personal data breach?

Answer: Privacy incident reporting channel and training on what constitutes a reportable event

Effective breach response depends on employees recognizing privacy incidents and knowing how to report them promptly through a clear escalation path.