CIPP-US practice questions 51–60

1. Question 51 · 236 in bank

   Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer Protection Act?

   • AFinancial institutions must avoid collecting a customer’s sensitive personal information
   • BFinancial institutions must help ensure a customer’s understanding of products and services
   • CFinancial institutions must use a prescribed level of encryption for most types of customer records
   • DFinancial institutions must cease sending e-mails and other forms of advertising to customers who opt out of direct marketing

   Show answer

   Answer: B

   Next question

2. Question 52 · 236 in bank

   Which act violates the Family Educational Rights and Privacy Act of 1974 (FERPA)?

   • AA K-12 assessment vendor obtains a student’s signed essay about her hometown from her school to use as an exemplar for public release
   • BA university posts a public student directory that includes names, hometowns, e-mail addresses, and majors
   • CA newspaper prints the names, grade levels, and hometowns of students who made the quarterly honor roll
   • DUniversity police provide an arrest report to a student’s hometown police, who suspect him of a similar crime

   Show answer

   Answer: C

   Next question

3. Question 53 · 236 in bank

   According to FERPA, when can a school disclose records without a student’s consent?

   • AIf the disclosure is not to be conducted through email to the third party
   • BIf the disclosure would not reveal a student’s student identification number
   • CIf the disclosure is to practitioners who are involved in a student’s health care
   • DIf the disclosure is to provide transcripts to a school where a student intends to enroll

   Show answer

   Answer: D

   Next question

4. Question 54 · 236 in bank

   What is the main purpose of the CAN-SPAM Act?

   • ATo diminish the use of electronic messages to send sexually explicit materials
   • BTo authorize the states to enforce federal privacy laws for electronic marketing
   • CTo empower the FTC to create rules for messages containing sexually explicit content
   • DTo ensure that organizations respect individual rights when using electronic advertising

   Show answer

   Answer: D

   Next question

5. Question 55 · 236 in bank

   The Video Privacy Protection Act of 1988 restricted which of the following?

   • AWhich purchase records of audio visual materials may be disclosed
   • BWhen downloading of copyrighted audio visual materials is allowed
   • CWhen a user’s viewing of online video content can be monitored
   • DWho advertisements for videos and video games may target

   Show answer

   Answer: A

   Next question

6. Question 56 · 236 in bank

   The Cable Communications Policy Act of 1984 requires which activity?

   • ADelivery of an annual notice detailing how subscriber information is to be used
   • BDestruction of personal information a maximum of six months after it is no longer needed
   • CNotice to subscribers of any investigation involving unauthorized reception of cable services
   • DObtaining subscriber consent for disseminating any personal information necessary to render cable services

   Show answer

   Answer: A

   Next question

7. Question 57 · 236 in bank

   What is the main purpose of requiring marketers to use the Wireless Domain Registry?

   • ATo access a current list of wireless domain names
   • BTo prevent unauthorized emails to mobile devices
   • CTo acquire authorization to send emails to mobile devices
   • DTo ensure their emails are sent to actual wireless subscribers

   Show answer

   Answer: B

   Next question

8. Question 58 · 236 in bank

   SCENARIO - Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach. What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might impose a penalty on HealthCo?

   • ABecause HealthCo did not require CloudHealth to implement appropriate physical and administrative measures to safeguard the ePHI
   • BBecause HealthCo did not conduct due diligence to verify or monitor CloudHealth’s security measures
   • CBecause HIPAA requires the imposition of a fine if a data breach of this magnitude has occurred
   • DBecause CloudHealth violated its contract with HealthCo by not encrypting the ePHI

   Show answer

   Answer: B

   Next question

9. Question 59 · 236 in bank

   SCENARIO - Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach. What is the most effective kind of training CloudHealth could have given its employees to help prevent this type of data breach?

   • ATraining on techniques for identifying phishing attempts
   • BTraining on the terms of the contractual agreement with HealthCo
   • CTraining on the difference between confidential and non-public information
   • DTraining on CloudHealth’s HR policy regarding the role of employees involved data breaches

   Show answer

   Answer: A

   Next question

10. Question 60 · 236 in bank

    SCENARIO - Please use the following to answer the next question: You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth’s security measures. A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI of public figures including celebrities and politicians. During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected. A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s attorney has submitted a discovery request for the ePHI exposed in the breach. Of the safeguards required by the HIPAA Security Rule, which of the following is NOT at issue due to HealthCo’s actions?

    • AAdministrative Safeguards
    • BTechnical Safeguards
    • CPhysical Safeguards
    • DSecurity Safeguards

    Show answer

    Answer: C

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CIPP-US practice, question 51. 236 questions available.