CIPP-US practice questions 151–160

1. Question 151 · 236 in bank

   Which of the following scenarios would be most likely to violate the Fourth Amendment of the U.S. Constitution with regard to contact tracing?

   • AA private employer conducting a voluntary contact-tracing program with its employees.
   • BAn employer asking employees if they have been diagnosed with or tested for COVID-19 before allowing them to physically enter the workplace.
   • CA government program that installs a contact-tracing app on an individual's phone and collects data after providing notice and obtaining the individual’s consent.
   • DA government program that automatically installs a contact-tracing app on an individual's phone and collects data without obtaining the individual’s consent.

   Show answer

   Answer: D

   Next question

2. Question 152 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. Which of the following would accurately describe the relationship of the parties if they enter into a contract for use of the app?

   • AMiraculous Healthcare would be the covered entity because its name and branding are on the app; MedApps would be a business associate because it is hosting the data that supports the app.
   • BMedApps would be the covered entity because it built and hosts the app and all the data; Miraculous Healthcare would be a business associate because it only provides its brand on the app.
   • CMiraculous Healthcare would be a covered entity because it is the healthcare provider; MedApps would also be a covered entity because the data in the app is being shared with it.
   • DMiraculous Healthcare would be the covered entity because it is the healthcare provider; MedApps would be a business associate because it is providing a service to support Miraculous.

   Show answer

   Answer: D

   Next question

3. Question 153 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. What HIPAA compliance issue would Miraculous have to consider before using the telehealth app?

   • AHIPAA does not permit healthcare providers to use cloud hosting services.
   • BHIPAA does not permit in-person appointment data to be hosted in the cloud.
   • CHIPAA would require Miraculous and MedApps to enter into a Business Associate Agreement.
   • DHIPAA would require Miraculous to obtain patient consent before in-person appointment data can be shared with third parties.

   Show answer

   Answer: C

   Next question

4. Question 154 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. What can Riya do to most effectively minimize the privacy risks of using an app for telehealth appointments?

   • ARequire MedApps to de-identity all patient data.
   • BProhibit MedApps from using subcontractors.
   • CRequire MedApps to submit a SOC2 report.
   • DEngage in active oversight of MedApps.

   Show answer

   Answer: D

   Next question

5. Question 155 · 236 in bank

   SCENARIO - Please use the following to answer the next question: Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative, Miraculous is considering a product built by MedApps, a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices’ branding. MedApps provides technical support for the app, which it hosts in the cloud. MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service. Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices, as well as negotiating the terms of vendor agreements. Riya is currently reviewing the suitability of the MedApps app from a privacy perspective. Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps’ optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps. If MedApps receives an access request under CCPA from a California-based app user, how should it handle the request?

   • AMedApps should decline the request because Protected Health Information is not subject to CCPA.
   • BMedApps should promptly verify the user's identity and provide the requested information.
   • CMedApps should promptly forward the request to Miraculous for instructions on handling.
   • DMedApps should decline the request because MedApps is not based in California.

   Show answer

   Answer: C

   Next question

6. Question 156 · 236 in bank

   Under what conditions will personal data processing be subject to the Virginia Consumer Data Protection Act (VCDPA) requirements for a documented data protection assessment?

   • AIf the data subject is younger than 13 years of age and the data is processed after January 1, 2023.
   • BIf the data processor processes personal data beyond the controller's instructions.
   • CIf the personal data is stored by a California-based third-party service provider.
   • DIf the personal data is processed for purposes of targeted advertising.

   Show answer

   Answer: D

   Next question

7. Question 157 · 236 in bank

   What was unique about the action that the Federal Trade Commission took against B.J.’s Wholesale Club in 2005?

   • AIt made third-party audits a penalty for policy violations.
   • BIt was based on matters of fairness rather than deception.
   • CIt was the first substantial U.S.-EU Safe Harbor enforcement.
   • DIt made user consent mandatory after any revisions of policy.

   Show answer

   Answer: A

   Next question

8. Question 158 · 236 in bank

   What are the maximum statutory damages for violations of the Fair Credit Reporting Act (FCRA)?

   • A$500 per violation
   • B$1,000 per violation
   • C$2,000 per violation
   • D$5,000 per violation

   Show answer

   Answer: B

   Next question

9. Question 159 · 236 in bank

   A company based in United States receives information about its UK subsidiary’s employees in connection with the centralized HR service it provides. How can the UK company ensure an adequate level of data protection that would allow the restricted data transfer to continue?

   • ABy signing up to an approved code of conduct under UK GDPR to demonstrate compliance with its requirements, both for the parent and the subsidiary companies.
   • BBy revising the contract with the United States parent company incorporating EU SCCs, as it continues to be valid for restricted transfers under the UK regime.
   • CBy submitting to the ICO a new application for the UK BCRs using the UK BCR application forms, as their existing authorized EU BCRs are not recognized.
   • DBy allowing each employee the option to opt-out to the restricted transfer, as it is necessary to send their names in order to book the sales bonuses.

   Show answer

   Answer: C

   Next question

10. Question 160 · 236 in bank

    The use of cookies on a website by a service provider is generally not deemed a ‘sale’ of personal information by CCPA, as long as which of the following conditions is met?

    • AThe third party stores personal information to trigger a response to a consumer’s request to exercise their right to opt in.
    • BThe analytics cookies placed by the service provider are capable of being tracked but cannot be linked to a particular consumer of that business.
    • CThe service provider retains personal information obtained in the course of providing the services specified in the agreement with the subcontractors.
    • DThe information collected by the service provider is necessary to perform debugging and the business and service provider have entered into an appropriate agreement.

    Show answer

    Answer: D

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 151. 236 questions available.