Safety and Compliance Flashcards

A consultant gets patient records from a healthcare client. Which law governs the protection of this information?

Answer: HIPAA

HIPAA protects individually identifiable health information held by covered entities and their business associates.

Under HIPAA, what agreement must a covered entity sign with a consultant who will handle protected health information?

Answer: Business Associate Agreement

HIPAA requires a Business Associate Agreement before a vendor creates, receives, maintains, or transmits PHI for a covered entity.

Which U.S. law requires financial institutions to explain their information-sharing practices and protect customer data?

Answer: Gramm-Leach-Bliley Act

The GLBA requires privacy notices and safeguards for consumers' nonpublic personal financial information.

A consultant's laptop holding unencrypted client customer data is stolen. What should happen first?

Answer: Report the incident promptly to the firm and the client under the incident response plan

Prompt reporting starts the incident response and any breach notification obligations under state laws and contracts.

What does the principle of 'data minimization' require?

Answer: Collecting and keeping only the data needed for a specific purpose

Data minimization limits collection and retention to what is necessary for the stated purpose.

Which U.S. state law gives residents rights to know about, delete, and opt out of the sale or sharing of their personal information?

Answer: California Consumer Privacy Act (CCPA)

The CCPA, as amended by the CPRA, grants California residents these privacy rights.

Which control best protects against unauthorized access to sensitive client files shared during an engagement?

Answer: Role-based access with multi-factor authentication

Role-based access combined with MFA limits access to authorized users and reduces credential-based breaches.