PLC Data Breach Response & Incident Management

Question 1

Under HIPAA, covered entities must notify affected individuals of a breach affecting their protected health information within how many days of discovering the breach?

Accepted Answer

60 days

Answer

HIPAA's Breach Notification Rule requires covered entities to notify affected individuals within 60 days of discovering a breach of unsecured PHI.

Question 2

Under the GDPR (applicable to US companies with EU data subjects), a personal data breach must be reported to the supervisory authority within how many hours of becoming aware?

Accepted Answer

72 hours

Answer

GDPR Article 33 requires notification to the supervisory authority within 72 hours of becoming aware of a personal data breach, where feasible.

Question 3

Which US federal law requires financial institutions to notify customers of a security breach involving their personal financial information?

Accepted Answer

Gramm-Leach-Bliley Act (GLBA)

Answer

The GLBA Safeguards Rule requires financial institutions to notify affected customers when their personal financial information is breached.

Question 4

A company discovers that an employee accidentally emailed a spreadsheet containing 500 customers' Social Security numbers to the wrong recipient. What is the FIRST step in proper incident response?

Accepted Answer

Contain the incident and assess its scope

Answer

Incident response best practice dictates that containment and assessment of scope must occur first before notifications or external reporting.

Question 5

Which of the following is NOT typically required in a state breach notification letter to affected individuals?

Accepted Answer

The name of the employee responsible for the breach

Answer

State breach notification laws do not require naming the responsible employee; they require a description of the incident, data types involved, and remediation steps.

PLC - Privacy Law Certification Practice Test

PLC - Privacy Law Certification Practice Test

PLC Data Breach Response & Incident Management