CRM Legal & Regulatory Compliance 3

Question 1

Under HIPAA, how long must a covered entity retain its written privacy policies and procedures?

Accepted Answer

6 years from creation or last effective date

Answer

HIPAA requires covered entities to retain privacy policies, procedures, and related documentation for 6 years from the date of creation or the date it was last in effect.

Question 2

The Gramm-Leach-Bliley Act (GLBA) Safeguards Rule primarily requires financial institutions to do which of the following?

Accepted Answer

Develop and maintain a written information security program

Answer

The GLBA Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive written information security program to protect customer information.

Question 3

Which principle from the EU General Data Protection Regulation (GDPR) limits how long personal data may be retained?

Accepted Answer

Storage limitation

Answer

GDPR's storage limitation principle requires that personal data be kept in a form that permits identification of data subjects for no longer than necessary for the processing purpose.

Question 4

An organization operating in California must comply with which state privacy law that grants consumers the right to request deletion of their personal information?

Accepted Answer

California Consumer Privacy Act (CCPA)

Answer

The CCPA grants California consumers the right to request that businesses delete their personal information, subject to certain exceptions.

Question 5

Under the Securities Exchange Act, broker-dealers must retain certain records for a minimum of how many years?

Accepted Answer

3 years for most records; 6 years for certain records

Answer

SEC Rule 17a-4 requires broker-dealers to retain most records for 3 years and certain records (such as blotters and general ledgers) for 6 years.

(CRM) Certified Records Management Practice Test

(CRM) Certified Records Management Practice Test

CRM Legal & Regulatory Compliance 3