CIPT Privacy Incident Response and Breach Management 2

Question 1

Under the HIPAA Breach Notification Rule, covered entities must notify affected individuals within how many days of discovering a breach?

Accepted Answer

60 calendar days

Answer

The HIPAA Breach Notification Rule requires notification to affected individuals without unreasonable delay and no later than 60 calendar days of breach discovery.

Question 2

Which US federal rule requires financial institutions to notify the FTC and customers following certain data breaches affecting 500 or more customers?

Accepted Answer

GLBA Safeguards Rule

Answer

The FTC's updated Gramm-Leach-Bliley Act (GLBA) Safeguards Rule requires financial institutions to report qualifying breaches affecting 500+ customers to the FTC.

Question 3

What is the 'risk of harm' standard primarily used for in breach notification decisions?

Accepted Answer

Establishing whether the severity of potential harm to individuals triggers mandatory notification

Answer

The risk of harm standard acts as a threshold test—notification is required only when a breach creates a sufficient risk of real harm to affected individuals.

Question 4

Which element is generally NOT required in a breach notification sent directly to affected individuals?

Accepted Answer

A list of all employees who handled the breached data internally

Answer

Breach notifications must help individuals protect themselves but do not require disclosing internal personnel details, which would not aid the affected person.

Question 5

When reporting a data breach to a supervisory authority under GDPR Article 33, what information must be included?

Accepted Answer

The nature of the breach, categories of data affected, likely consequences, and measures taken

Answer

GDPR Article 33(3) specifies the notification must describe the breach nature, data categories, approximate number affected, likely consequences, and remediation measures.

CIPT - Certified Information Privacy Technologist Practice Test

CIPT - Certified Information Privacy Technologist Practice Test

CIPT Privacy Incident Response and Breach Management 2