CIPT Privacy Incident Response and Breach Management 2

Question 1

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals within how many days of discovering a breach?

Accepted Answer

60 calendar days

Answer

30 calendar days

Answer

45 calendar days

Answer

90 calendar days

Question 2

Which US federal rule requires financial institutions to notify the FTC and customers following certain data breaches affecting 500 or more customers?

Accepted Answer

GLBA Safeguards Rule

Answer

COPPA Safe Harbor Rule

Answer

CAN-SPAM Enforcement Rule

Answer

FERPA Disclosure Rule

Question 3

What is the 'risk of harm' standard primarily used for in breach notification decisions?

Accepted Answer

Establishing whether the severity of potential harm to individuals triggers mandatory notification

Answer

Determining the financial penalties owed to regulators after a breach

Answer

Calculating compensation amounts owed to individual data subjects

Answer

Setting the regulatory reporting timeline after a breach is discovered

Question 4

Which element is generally NOT required in a breach notification sent directly to affected individuals?

Accepted Answer

A list of all employees who handled the breached data internally

Answer

Description of the types of personal information involved in the breach

Answer

Steps individuals can take to protect themselves from potential harm

Answer

Contact information for the notifying organization

Question 5

When reporting a data breach to a supervisory authority under GDPR Article 33, what information must be included?

Accepted Answer

The nature of the breach, categories of data affected, likely consequences, and measures taken

Answer

The full names of all data subjects whose data was affected

Answer

A complete audit trail of all prior data processing activities

Answer

Proof of active cyber insurance coverage at the time of the breach

Question 6

The FTC's Health Breach Notification Rule applies primarily to which type of entity?

Accepted Answer

Vendors of personal health records and related apps not subject to HIPAA

Answer

HIPAA-covered entities such as hospitals and health insurers

Answer

All businesses that collect or process any health-related data

Answer

State health departments and public health agencies

Question 7

What is 'substitute notice' in the context of breach notification laws?

Accepted Answer

Alternative notification methods such as website posting or media notice when direct contact is impractical or cost-prohibitive

Answer

Using a third-party vendor to send breach notifications on behalf of the organization

Answer

Notifying regulators in lieu of notifying affected individuals

Answer

Sending a condensed summary notice rather than a full breach disclosure document