Legal Framework & Constitutional Law Flashcards

Under HIPAA's Security Rule, which category of safeguards specifically requires workforce training and access management policies?

Answer: Administrative safeguards

Administrative safeguards under the HIPAA Security Rule address workforce security, training, access management, and contingency planning through documented policies and procedures.

A financial institution collects customer data and must comply with the Gramm-Leach-Bliley Act (GLBA). Which rule specifically requires a written information security program?

Answer: Safeguards Rule

The GLBA Safeguards Rule (implemented by the FTC) requires financial institutions to develop, implement, and maintain a comprehensive written information security program.

The California Consumer Privacy Act (CCPA) grants consumers the right to know what personal information is collected about them and the right to:

Answer: Request deletion of their personal information

The CCPA grants California consumers the right to request deletion of personal information held by businesses, subject to certain exceptions.

Which federal agency has primary enforcement authority over commercial entities' compliance with COPPA (Children's Online Privacy Protection Act)?

Answer: Federal Trade Commission (FTC)

The FTC is the primary federal enforcement agency for COPPA, which restricts online collection of personal information from children under 13 without verifiable parental consent.

Under the EU General Data Protection Regulation (GDPR), what is the maximum fine for the most serious violations (Tier 2)?

Answer: €20 million or 4% of global annual turnover, whichever is higher

GDPR Tier 2 penalties for violations of core principles and data subject rights can reach €20 million or 4% of total worldwide annual turnover, whichever is higher.

A healthcare organization experiences a breach of unsecured PHI affecting 600 individuals. Under HIPAA, the breach notification deadline to the Department of Health and Human Services (HHS) is:

Answer: Within 60 days of the end of the calendar year in which the breach occurred

For breaches affecting fewer than 500 individuals, HIPAA requires notification to HHS no later than 60 days after the end of the calendar year in which the breach occurred.

Which privacy principle, foundational to the GDPR and many US frameworks, requires that personal data be collected only for specified, explicit, and legitimate purposes and not further processed in ways incompatible with those purposes?

Answer: Purpose limitation

Purpose limitation restricts organizations to using personal data only for the purposes for which it was originally collected, preventing secondary use incompatible with the original intent.