CSC CSC - Cybersecurity Compliance Data Privacy and Breach Notification Laws Questions and Answers 2

Question 1

What is the maximum number of days most U.S. state breach notification laws require businesses to notify affected individuals after discovering a breach?

Accepted Answer

30 to 90 days depending on state law

Answer

180 days

Answer

7 days

Answer

1 year

Question 2

Under which federal law must covered entities notify the HHS Secretary and affected individuals within 60 days of discovering a breach of unsecured protected health information?

Accepted Answer

HIPAA Breach Notification Rule

Answer

GLBA Safeguards Rule

Answer

FISMA

Answer

COPPA

Question 3

Which of the following would likely trigger a state data breach notification requirement in the U.S.?

Accepted Answer

Unauthorized access to unencrypted Social Security numbers

Answer

Accidental deletion of anonymized survey data

Answer

Loss of encrypted files where the encryption key was not compromised

Answer

An employee viewing authorized records outside business hours

Question 4

What is the 'safe harbor' provision in the context of U.S. data breach notification laws?

Accepted Answer

An exemption from notification when breached data was encrypted

Answer

A grace period to delay notification by 90 additional days

Answer

A federal preemption clause overriding all state laws

Answer

An opt-out right for businesses with fewer than 50 employees

Question 5

Which type of personal information is most commonly covered by U.S. state breach notification statutes?

Accepted Answer

Name combined with SSN, financial account number, or driver's license number

Answer

Publicly available government records only

Answer

Encrypted health records stored on air-gapped systems

Answer

General demographic data such as age and zip code

Question 6

Which U.S. federal agency is responsible for overseeing breach notification compliance in the healthcare sector?

Accepted Answer

HHS Office for Civil Rights (OCR)

Answer

Federal Trade Commission (FTC)

Answer

CISA

Answer

Department of Justice