IAPP Certified Information Privacy Professional/United States (CIPP/US) - CIPP-US

SCENARIO
Please use the following to answer the next question:
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis.
This would mean restricting employees' access to customer information to data that was relevant to the work performed. Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information.
Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
What could the company have done differently prior to the breach to reduce their risk?

• A. Honored the promise of its privacy policy to acquire information by using an opt-in method.
• B. Looked for any persistent threats to security that could compromise the company's network.
• C. Implemented a comprehensive policy for accessing customer information.
• D. Communicated requests for changes to users' preferences across the organization and with third parties.

SCENARIO
Please use the following to answer the next question:
Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering teleheaith appointments, where patients can have virtual appointments with on-site doctors via a phone app. For this new initiative. Miraculous is considering a product built by MedApps, a company that makes quality teleheaith apps for healthcare practices and licenses them to be used with the practices' branding. MedApps provides technical support for the app. which it hosts in the cloud MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service.
Riya is the Privacy Officer at Miraculous, responsible for the practice's compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices. as well as negotiating the terms of vendor agreements Riya is currently reviewing the suitability of the MedApps app from a privacy perspective.
Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps.
What is the most practical action Riya can take to minimize the privacy risks of using an app for telehealth appointments?

• A. Prevent MedApps from using copies of the patient data.
• B. Require MedApps to submit a SOC2 report.
• C. Engage in active oversight of MedApps
• D. Require MedApps to obtain consent from all patients.

What is the purpose of a cure provision in a stale data privacy law?

• A. To allow certain provisions of a law to expire after a defined time period
• B. To allow a business a limited timeframe to fix alleged violations before facing enforcement.
• C. To allow a state to initiate formal enforcement actions for a fixed time period.
• D. To allow consumers a period of time to discover their data has been mishandled

All of the following common law torts are relevant to employee privacy under US law EXCEPT?

• A. Infliction of emotional distress.
• B. Conversion.
• C. Intrusion upon seclusion.
• D. Defamation

The use of cookies on a website by a service provider is generally not deemed a `sale' of personal information by CCPA, as long as which of the following conditions is met?

• A. The third party stores personal information to trigger a response to a consumer's request to exercise their right to opt in.
• B. The analytics cookies placed by the service provider are capable of being tracked but cannot be linked to a particular consumer of that business.
• C. The service provider retains personal information obtained in the course of providing the services specified in the agreement with the subcontractors.
• D. The information collected by the service provider is necessary to perform debugging and the business and service provider have entered into an appropriate agreement.