Pass Your CIPP-US Dumps as PDF Updated on 2024 With 170 Questions [Q25-Q50]

Pass Your CIPP-US Dumps as PDF Updated on 2024 With 170 Questions

IAPP CIPP-US Real Exam Questions and Answers FREE

NEW QUESTION # 25
Federal laws establish which of the following requirements for collecting personal information of minors under the age of 13?

• A. Affirmative consent of a parent or guardian before collecting personal information of a minor offline (e.g., in person), which also satisfies any requirements for online consent.
• B. Affirmative consent from a minor's parent or guardian before collecting the minor's personal information online.
• C. Implied consent from a minor's parent or guardian, or affirmative consent from the minor.
• D. Implied consent from a minor's parent or guardian before collecting a minor's personal information online, such as when they permit the minor to use the internet.

Answer: B

NEW QUESTION # 26
A student has left high school and is attending a public postsecondary institution. Under what condition may a school legally disclose educational records to the parents of the student without consent?

• A. If the student is still a dependent for tax purposes
• B. If the student is in danger of academic suspension
• C. If the student has applied to transfer to another institution
• D. If the student has not yet turned 18 years of age

Answer: A

Explanation:
Explanation/Reference: https://www2.ed.gov/policy/gen/guid/fpco/pdf/ferpafaq.pdf

NEW QUESTION # 27
SCENARIO
Please use the following to answer the next QUESTION
When there was a data breach involving customer personal and financial information at a large retail store, the company's directors were shocked. However, Roberta, a privacy analyst at the company and a victim of identity theft herself, was not. Prior to the breach, she had been working on a privacy program report for the executives. How the company shared and handled data across its organization was a major concern. There were neither adequate rules about access to customer information nor procedures for purging and destroying outdated data. In her research, Roberta had discovered that even low- level employees had access to all of the company's customer data, including financial records, and that the company still had in its possession obsolete customer data going back to the 1980s.
Her report recommended three main reforms. First, permit access on an as-needs-to-know basis. This would mean restricting employees' access to customer information to data that was relevant to the work performed.
Second, create a highly secure database for storing customers' financial information (e.g., credit card and bank account numbers) separate from less sensitive information. Third, identify outdated customer information and then develop a process for securely disposing of it.
When the breach occurred, the company's executives called Roberta to a meeting where she presented the recommendations in her report. She explained that the company having a national customer base meant it would have to ensure that it complied with all relevant state breach notification laws. Thanks to Roberta's guidance, the company was able to notify customers quickly and within the specific timeframes set by state breach notification laws.
Soon after, the executives approved the changes to the privacy program that Roberta recommended in her report. The privacy program is far more effective now because of these changes and, also, because privacy and security are now considered the responsibility of every employee.
What could the company have done differently prior to the breach to reduce their risk?

• A. Implemented a comprehensive policy for accessing customer information.
• B. Communicated requests for changes to users' preferences across the organization and with third parties.
• C. Looked for any persistent threats to security that could compromise the company's network.
• D. Honored the promise of its privacy policy to acquire information by using an opt-in method.

Answer: A

Explanation:
The scenario suggests that the company lacked adequate rules about access to customer information, which increased the risk of unauthorized access and data breach. Implementing a comprehensive policy for accessing customer information would have helped the company to limit the access to only those who need it for legitimate purposes, and to protect the confidentiality, integrity, and availability of the data. This is also one of the recommendations that Roberta made in her report. References:
* CIPP/US Practice Questions (Sample Questions), Question 116, Answer A, Explanation A.
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 5, Section 5.2, p. 143.

NEW QUESTION # 28
Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?

• A. The entity must conduct business in the state
• B. The entity must have employees in the state
• C. The entity must be an information broker
• D. The entity must be registered in the state

Answer: A

Explanation:
Most state laws require that a person or business that conducts business in the state and owns or licenses personal information of residents of that state must notify those residents of any breach of the security of the system involving their personal information. This means that the entity does not have to be physically located in the state, have employees in the state, or be registered inthe state to be subject to the breach notification requirements, as long as it conducts business in the state and holds personal information of state residents.
Conducting business in the state can be interpreted broadly to include any transaction or activity that involves the state or its residents, such as selling goods or services, collecting payments, or maintaining a website accessible by state residents. The other options (B, C, and D) are not commonly required by most state laws, although some states may have additional or specific requirements for certain types of entities, such as information brokers, health care providers, or financial institutions. References:
* Security Breach Notification Chart | Perkins Coie
* Security Breach Notification Laws - National Conference of State Legislatures
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 4: State Privacy Laws and Regulations, Section 4.2: State Security Breach Notification Laws.

NEW QUESTION # 29
What privacy concept grants a consumer the right to view and correct errors on his or her credit report?

• A. Action.
• B. Notice.
• C. Access.
• D. Choice.

Answer: C

Explanation:
Access is the privacy concept that grants a consumer the right to view and correct errors on his or her credit report. The Fair Credit Reporting Act (FCRA) gives consumers the right to access their credit reports from the three nationwide credit reporting agencies (Equifax, Experian, and TransUnion) once every 12 months for free. Consumers also have the right to dispute any inaccurate or incomplete information in their credit reports and request that the credit reporting agencies investigate and correct the errors. The FCRA also requires the credit reporting agencies to provide consumers with a notice of their rights and a summary of the dispute process. References:
* IAPP CIPP/US Certified Information Privacy Professional Study Guide, Chapter 2: Limits on Private-sector Collection and Use of Data, Section 2.2: Consumer Privacy, p. 38-39
* IAPP CIPP/US Body of Knowledge, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.B: Identify the privacy requirements for consumer data, Subobjective II.B.1: Identify the consumer rights under the Fair Credit Reporting Act, p. 13
* IAPP CIPP/US Exam Blueprint, Domain II: Limits on Private-sector Collection and Use of Data, Objective II.B: Identify the privacy requirements for consumer data, Subobjective II.B.1: Identify the consumer rights under the Fair Credit Reporting Act, p. 4

NEW QUESTION # 30
What practice does the USA FREEDOM Act NOT authorize?

• A. The bulk collection of telephone data and internet metadata
• B. An increase in the maximum penalty for material support to terrorism
• C. An extension of the expiration for roving wiretaps
• D. Emergency exceptions that allows the government to target roamers

Answer: D

Explanation:
Explanation/Reference: https://www.rand.org/blog/2015/05/the-usa-freedom-act-the-definition-of-a-compromise.html

NEW QUESTION # 31
What was the original purpose of the Foreign Intelligence Surveillance Act?

• A. To further clarify when a warrant is not required for a wiretap performed internally by the telephone company outside the suspect's home, stemming from the Olmstead v. United States decision.
• B. To further define what information can reasonably be under surveillance in public places under the USA PATRIOT Act, such as Internet access in public libraries.
• C. To further clarify a reasonable expectation of privacy stemming from the Katz v. United States decision.
• D. To further define a framework for authorizing wiretaps by the executive branch for national security purposes under Article II of the Constitution.

Answer: B

NEW QUESTION # 32
The Video Privacy Protection Act of 1988 restricted which of the following?

• A. Which purchase records of audio visual materials may be disclosed
• B. When downloading of copyrighted audio visual materials is allowed
• C. When a user's viewing of online video content can be monitored
• D. Who advertisements for videos and video games may target

Answer: A

Explanation:
Explanation/Reference: https://searchcompliance.techtarget.com/definition/Video-Privacy-Protection-Act-of-1988

NEW QUESTION # 33
Although an employer may have a strong incentive or legal obligation to monitor employees' conduct or behavior, some excessive monitoring may be considered an intrusion on employees' privacy? Which of the following is the strongest example of excessive monitoring by the employer?

• A. An employer who records all employee phone calls that involve financial transactions with customers completed over the phone.
• B. An employer who installs data loss prevention software on all employee computers to limit transmission of confidential company information.
• C. An employer who installs a video monitor in physical locations, such as a warehouse, to ensure employees are performing tasks in a safe manner and environment.
• D. An employer who installs video monitors in physical locations, such as a changing room, to reduce the risk of sexual harassment.

Answer: D

NEW QUESTION # 34
A large online bookseller decides to contract with a vendor to manage Personal Information (PI). What is the least important factor for the company to consider when selecting the vendor?

• A. The vendor's employee retention rates
• B. The vendor's financial health
• C. The vendor's reputation
• D. The vendor's employee training program

Answer: B

NEW QUESTION # 35
What was unique about the action that the Federal Trade Commission took against B.J.'s Wholesale Club in
2005?

• A. It made third-party audits a penalty for policy violations.
• B. It was based on matters of fairness rather than deception.
• C. It was the first substantial U.S.-EU Safe Harbor enforcement.
• D. It made user consent mandatory after any revisions of policy.

Answer: B

Explanation:
The Federal Trade Commission (FTC) is the primary federal agency that enforces consumer privacy and data security laws in the United States. The FTC has the authority to bring enforcement actions against businesses that engage in unfair or deceptive acts or practices that affect commerce, under Section 5 of the FTC Act.
Unfair acts or practices are those that cause or are likely to cause substantial injury to consumers that is not reasonably avoidable by consumers and is not outweighed by countervailing benefits to consumers or competition. Deceptive acts or practices are those that involve a material representation, omission, or practice that is likely to mislead consumers acting reasonably under the circumstances.
The FTC's action against B.J.'s Wholesale Club in 2005 was unique because it was based on matters of fairness rather than deception. The FTC alleged that B.J.'s Wholesale Club, a retailer that operates warehouse stores and gas stations, failed to provide reasonable security for the sensitive information of its customers, such as name, card number, and expiration date, that it collected from the magnetic stripes of credit and debit cards. The FTC claimed that this information was used by unauthorized persons to make millions of dollars of fraudulent purchases. The FTC did not allege that B.J.'s Wholesale Club made any false or misleading statements or omissions about its data security practices, but rather that its failure to take appropriate security measures was an unfair practice that violated Section 5 of the FTC Act. The FTC argued that B.J.'s Wholesale Club's lax security caused or was likely to cause substantial injury to consumers that was not reasonably avoidable by consumers and was not outweighed by any benefits to consumers or competition.
The FTC's action against B.J.'s Wholesale Club was one of the first cases in which the FTC used its unfairness authority to address data security issues,and it set a precedent for future enforcement actions against businesses that fail to protect consumer data. The settlement required B.J.'s Wholesale Club to implement a comprehensive information security program and obtain audits by an independent third-party security professional every other year for 20 years. References:
* FTC Complaint, Paragraphs 1-23
* FTC Agreement Containing Consent Order, Paragraphs 1-9
* FTC Analysis of Proposed Consent Order to Aid Public Comment, Pages 1-3
* [IAPP CIPP/US Study Guide], Pages 69-70

NEW QUESTION # 36
SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Based on the way he uses social media, Evan is susceptible to a lawsuit based on?

• A. Discrimination
• B. Publicity given to private life
• C. Intrusion upon seclusion
• D. Defamation

Answer: A

NEW QUESTION # 37
California's SB 1386 was the first law of its type in the United States to do what?

• A. Require notification of non-California residents of a breach that occurred in California
• B. Require commercial entities to disclose a security data breach concerning personal information about the state's residents
• C. Require encryption of sensitive information stored on servers that are Internet connected
• D. Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices

Answer: B

Explanation:
California's SB 1386, also known as the California Security Breach Information Act, was enacted in 2002 and became effective in 2003. It was the first law of its kind in the United States to require commercial entities that own or license personal information of California residents to notify them in the event of a security breach that compromises their unencrypted data. The law aims to protect the privacy and security of personal information and to enable individuals to take preventive measures against identity theft and fraud. The law applies to any business or person that conducts business in California and that owns or licenses computerized data that includes personal information, as defined by the law. Personal information includes an individual's first name or first initial and last name in combination with any one or more of the following data elements: Social Security number, driver's license number or California identification card number, account number, credit or debit card number, in combination with any required security code, access code, or password that would permit access to an individual's financial account, or medical information or health insurance information. The law does not apply to encrypted information, publicly available information, or information that is lawfully obtained from federal, state, or local government records. The law requires the disclosure of a breach of the security of the system to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. The disclosure may be made by written notice, electronic notice, or substitute notice, as specified by the law. The law also requires any person or business that maintains computerized data that includes personal information that the person or business does not own to notify the owner or licensee of the information of any breach of the security of the data immediately following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The law also authorizes a civil action for damages by a customer injured by a violation of the law and provides that the rights and remedies available under the law are cumulative to each other and to any other rights and remedies available under law. References:
* California Senate Bill 1386 (2002)
* California SB 1386: For the Love of Privacy
* What Is the California Security Breach Information Act?
* California Raises the Bar on Data Security and Privacy

NEW QUESTION # 38
Which of the following would NOT constitute an exception to the authorization requirement under the HIPAA Privacy Rule?

• A. Disclosing health information needed to pay a third party billing administrator.
• B. Disclosing health information for public health activities.
• C. Disclosing health information needed to treat a medical emergency.
• D. Disclosing health information to file a child abuse report.

Answer: A

Explanation:
The HIPAA Privacy Rule requires covered entities to obtain an individual's written authorization for any use or disclosure of protected health information (PHI) that is not for treatment, payment, or health care operations or otherwise permitted or required by the Privacy Rule. However, there are some exceptions to the authorization requirement for certain public interest-related activities, such as disclosing health information for public health activities, reporting child abuse, or treating a medical emergency. These exceptions are intended to balance the privacy interests of individuals with the public interest in protecting health and safety, promoting quality health care, and ensuring compliance with the law. Disclosing health information needed to pay a third party billing administrator is not one of the exceptions to the authorization requirement, as it is considered a payment activity that falls under the general rule of requiring authorization. Therefore, it is the correct answer to the question. References: Summary of the HIPAA Privacy Rule, HIPAA Exceptions, Exceptions to HIPAA Privacy Rule, Waiver of Authorization, IAPP CIPP/US Study Guide, Chapter 5.

NEW QUESTION # 39
The Cable Communications Policy Act of 1984 requires which activity?

• A. Delivery of an annual notice detailing how subscriber information is to be used
• B. Notice to subscribers of any investigation involving unauthorized reception of cable services
• C. Obtaining subscriber consent for disseminating any personal information necessary to render cable services
• D. Destruction of personal information a maximum of six months after it is no longer needed

Answer: A

Explanation:
The Cable Communications Policy Act of 1984 (CCPA) is a federal law that regulates the cable television industry and protects the privacy of cable subscribers. One of the provisions of the CCPA is that cable operators must providetheir subscribers with an annual notice that clearly and conspicuously informs them of the following information12:
* The nature of personally identifiable information collected or to be collected with respect to the subscriber and the nature of the use of such information
* The nature, frequency, and purpose of any disclosure of such information, including an identification of the types of persons to whom the disclosure may be made
* The period during which such information will be maintained by the cable operator
* The times and place at which the subscriber may have access to such information
* The limitations provided by the CCPA with respect to the collection and disclosure of information by a cable operator and the right of the subscriber under the CCPA to enforce such limitations The annual notice must also state that the subscriber has the right to prevent disclosure of personally identifiable information to third parties, except as required by law or court order, and that the subscriber may sue for damages, attorney's fees, and other relief for violations of the CCPA12.
References: 1: Cable Communications Policy Act of 1984, Section 631 2: [IAPP CIPP/US Study Guide], Chapter 8, Section 8.3.2

NEW QUESTION # 40
If an organization maintains data classified as high sensitivity in the same system as data classified as low sensitivity, which of the following is the most likely outcome?

• A. The impact of an organizational data breach will be more severe than if the data had been segregated.
• B. The organization will still be in compliance with most sector-specific privacy and security laws.
• C. The organization will be able to address legal discovery requests efficiently without producing more information than necessary.
• D. Temporary employees will be able to find the data necessary to fulfill their responsibilities.

Answer: A

Explanation:
Data classification is the process of categorizing data based on its sensitivity and importance to determine its level of confidentiality and protection. Data classification helps organizations apply appropriate security and compliance measures to ensure each category receives proper protection1. Data classification also helps organizations identify which data is subject to specific privacylaws and regulations, such as the GDPR, HIPAA, or CCPA, and how to handle data subject requests, data breaches, or legal discovery2. If an organization maintains data classified as high sensitivity, such as personal information, financial information, or health information, in the same system as data classified as low sensitivity, such as public information or internal information, it increases the risk of exposing the high sensitivity data in the event of a data breach. A data breach can result in legal consequences, reputational damage, and loss of trust from customers and stakeholders. Therefore, it is advisable to segregate data based on its classification and apply different levels of encryption, access control, and monitoring to each category3. This way, the organization can minimize the impact of a data breach and protect the privacy and security of its data assets. References:
* Why Is Data Classification Important?
* Data Classification for GDPR Explained
* Data classification and privacy considerations

NEW QUESTION # 41
SCENARIO
Please use the following to answer the next question :
You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud computing service provider, CloudHealth, stores and manages the electronic protected health information (ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of HealthCo's business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to implement security measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of CloudHealth's security measures.
A CloudHealth employee has recently become the victim of a phishing attack. When the employee unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the perpetrator as a known hacker who has launched similar attacks on other hospitals - ones that exposed the PHI of public figures including celebrities and politicians.
During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the breach and a copy of the PHI of the individuals affected.
A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the individual's ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient's attorney has submitted a discovery request for the ePHI exposed in the breach.
What is the most effective kind of training CloudHealth could have given its employees to help prevent this type of data breach?

• A. Training on the difference between confidential and non-public information
• B. Training on the terms of the contractual agreement with HealthCo
• C. Training on techniques for identifying phishing attempts
• D. Training on CloudHealth's HR policy regarding the role of employees involved data breaches

Answer: C

NEW QUESTION # 42
SCENARIO
Please use the following to answer the next QUESTION :
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state's Do Not Call list, as well as the people on it. "If they were really serious about not being bothered," Evan said, "They'd be on the national DNC list. That's the only one we're required to follow. At SunriseLynx, we call until they ask us not to." Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call "another time." This, to Larry, is a clear indication that they don't want to be called at all. Evan doesn't see it that way.
Larry believes that Evan's arrogance also affects the way he treats employees. The U.S. Constitution protects American workers, and Larry believes that the rights of those at SunriseLynx are violated regularly. At first Evan seemed friendly, even connecting with employees on social medi a. However, following Evan's political posts, it became clear to Larry that employees with similar affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several times, these have come to him already opened, even though this name was clearly marked. Larry thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights are being trampled under Evan's leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls are regularly recorded for quality assurance, and although Sadie is always professional during business, her personal conversations sometimes contain sexual comments. This too is something Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met with a shrug. It was the coworker's belief that employees agreed to be monitored when they signed on. Although personal devices are left alone, phone calls, emails and browsing histories are all subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an undercover investigation by an outside firm turned up evidence of misconduct. Although the employee may have stolen from the company, Evan could have simply contacted the authorities when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
Which act would authorize Evan's undercover investigation?

• A. The Fair and Accurate Credit Transactions Act (FACTA)
• B. The National Labor Relations Act (NLRA)
• C. The Whistleblower Protection Act
• D. The Stored Communications Act (SCA)

Answer: D

Explanation:
Stored communications. As previously discussed, the SCA creates a general prohibition against the unauthorized acquisition, alteration or blocking of electronic communications while in electronic storage in a facility through which an electronic communications service is provided.119 Violations for interceptions can lead to criminal penalties or a civil lawsuit. The law provides for exceptions. Two exceptions that may apply to the employer are for conduct authorized: "By the person or entity providing a wire or electronic communications service" (often the employer)120 "By a user of that service with respect to a communication of or intended for that user"121

NEW QUESTION # 43
Even when dealing with an organization subject to the CCPA, California residents are NOT legally entitled to request that the organization do what?

• A. Refrain from selling their personal information to third parties.
• B. Correct their personal information.
• C. Delete their personal information.
• D. Disclose their personal information to them.

Answer: B

Explanation:
The CCPA grants California residents the right to request that a business delete, disclose, or stop selling their personal information, but it does not grant them the right to request that a business correct their personal information. However, the CPRA, which will amend and expand the CCPA in 2023, will grant California residents the right to request that a business correct inaccurate personal information. References: CCPA, CPRA, IAPP CIPP/US Study Guide (p. 62)

NEW QUESTION # 44
Which of the following is commonly required for an entity to be subject to breach notification requirements under most state laws?

• A. The entity must conduct business in the state
• B. The entity must have employees in the state
• C. The entity must be an information broker
• D. The entity must be registered in the state

Answer: A

NEW QUESTION # 45
Smith Memorial Healthcare (SMH) is a hospital network headquartered in New York and operating in 7 other states. SMH uses an electronic medical record to enter and track information about its patients. Recently, SMH suffered a data breach where a third-party hacker was able to gain access to the SMH internal network.
Because it is a HIPPA-covered entity, SMH made a notification to the Office of Civil Rights at the U.S. Department of Health and Human Services about the breach.
Which statement accurately describes SMH's notification responsibilities?

• A. If SMH has more than 500 patients in the state of New York, it will need to make separate notifications to these patients.
• B. If SMH makes credit monitoring available to individuals who inquire, it will not have to make a separate
• C. If SMH is compliant with HIPAA, it will not have to make a separate notification to individuals in the state of New York.
• D. If SMH must make a notification in any other state in which it operates, it must also make a notification to individuals in New York.

Answer: C

Explanation:
notification to individuals in the state of New York.
Explanation:
https://www.perkinscoie.com/en/news-insights/security-breach-notification-chart-new-york.html

NEW QUESTION # 46
California's SB 1386 was the first law of its type in the United States to do what?

• A. Require notification of non-California residents of a breach that occurred in California
• B. Require commercial entities to disclose a security data breach concerning personal information about the state's residents
• C. Require encryption of sensitive information stored on servers that are Internet connected
• D. Require state attorney general enforcement of federal regulations against unfair and deceptive trade practices

Answer: B

NEW QUESTION # 47
SCENARIO
Please use the following to answer the next QUESTION
Noah is trying to get a new job involving the management of money. He has a poor personal credit rating, but he has made better financial decisions in the past two years.
One potential employer, Arnie's Emporium, recently called to tell Noah he did not get a position. As part of the application process, Noah signed a consent form allowing the employer to request his credit report from a consumer reporting agency (CRA). Noah thinks that the report hurt his chances, but believes that he may not ever know whether it was his credit that cost him the job. However, Noah is somewhat relieved that he was not offered this particular position. He noticed that the store where he interviewed was extremely disorganized. He imagines that his credit report could still be sitting in the office, unsecured.
Two days ago, Noah got another interview for a position at Sam's Market. The interviewer told Noah that his credit report would be a factor in the hiring decision. Noah was surprised because he had not seen anything on paper about this when he applied.
Regardless, the effect of Noah's credit on his employability troubles him, especially since he has tried so hard to improve it. Noah made his worst financial decisions fifteen years ago, and they led to bankruptcy. These were decisions he made as a young man, and most of his debt at the time consisted of student loans, credit card debt, and a few unpaid bills - all of which Noah is still working to pay off. He often laments that decisions he made fifteen years ago are still affecting him today.
In addition, Noah feels that an experience investing with a large bank may have contributed to his financial troubles. In 2007, in an effort to earn money to help pay off his debt, Noah talked to a customer service representative at a large investment company who urged him to purchase stocks. Without understanding the risks, Noah agreed. Unfortunately, Noah lost a great deal of money.
After losing the money, Noah was a customer of another financial institution that suffered a large security breach. Noah was one of millions of customers whose personal information was compromised. He wonders if he may have been a victim of identity theft and whether this may have negatively affected his credit.
Noah hopes that he will soon be able to put these challenges behind him, build excellent credit, and find the perfect job.
Consumers today are most likely protected from situations like the one Noah had buying stock because of which federal action or legislation?

• A. The creation of the Consumer Financial Protection Bureau.
• B. Federal Trade Commission investigations into "unfair and deceptive" acts or practices.
• C. The rules under the Fair Debt Collection Practices Act.
• D. Investigations of "abusive" acts and practices under the Dodd-Frank Wall Street Reform and Consumer Protection Act.

Answer: D

Explanation:
The Dodd-Frank Act was established to prevent the risky financial practices that led to the 2007-2008 financial crisis, which included issues similar to Noah's experience with buying stocks without understanding the risks. The act includes provisions forconsumer protection in financial services and aims to prevent abusive practices in the financial industry

NEW QUESTION # 48
What are banks required to do under the Gramm-Leach-Bliley Act (GLBA)?

• A. Provide consumers with the opportunity to opt out of receiving telemarketing phone calls
• B. Process requests for changes to user preferences within a designated time frame
• C. Conduct annual consumer surveys regarding satisfaction with user preferences
• D. Offer an Opt-Out before transferring PI to an unaffiliated third party for the latter's own use

Answer: D

Explanation:
Explanation/Reference: https://www.investopedia.com/terms/g/glba.asp

NEW QUESTION # 49
What was the original purpose of the Federal Trade Commission Act?

• A. To negotiate consent decrees with companies violating personal privacy
• B. To protect consumers
• C. To enforce antitrust laws
• D. To ensure privacy rights of U.S. citizens

Answer: C

Explanation:
IAPP book, Section 3.3, first sentence. "The FTC was founded in 1914 to enforce antitrust laws, and its general consumer protection mission was established by a statutory change in 1938." In particular in considering this answer, note that the FTC Act was initially passed in 1914.

NEW QUESTION # 50
......

Pass IAPP CIPP-US Exam Info and Free Practice Test: https://torrentpdf.actual4exams.com/CIPP-US-real-braindumps.html