CIPP US EXAMINATION TIPS 2025/2026 QUESTIONS WITH
ANSWERS GRADED A+
✔✔GINA (Genetic Information Nondiscrimination Act) - ✔✔became law on May 21,
2008; its basic purpose is to protect people from discrimination by health insurers and
employers based on genetic information.
Amended: ERISA, SSA, Civil Rights Act
No private right to action
✔✔HITECH impact on healthcare - ✔✔-Provided incentive payments to hospitals and
healthcare providers to adopt health IT.
-"Meaningful Use"- criteria required to be met that demonstrated meaningful use of
electronic health records (EHR). EHR technology must be used to achieve certain
objectives.
✔✔HITECH name - ✔✔Health Information Technology for Economic and Clinical Health
Act
✔✔HITECH Act of 2009 - ✔✔Strengthened HIPPA to address privacy impact on
electronic health records
Breach: must notify individuals within 60 days
if more than 500 people, notify HHS immediately
if 500 or more in same jurisdiction, notify media
Avoid liability for using encryption software
✔✔21st Century Cures Act 2016 - ✔✔Expedite research, quicken drug approval, reform
mental health
Certain biomedial research exempt from FOIA
Researchers can remotely view PHI
info blocking prohibited
certificates of confidentiality for research
can share mental health/substance abuse info with family
✔✔FACTA - Fair and Accurate Credit Transaction Act - ✔✔Amends FCRA to help fight
identity theft
CFPB = authority
Mandates limits on information sharing
Entitles consumers to annual free credit report
,Allows one to place fraud alerts, credit freezes
requires businesses to truncate credit/debit card numbers on receipts
Mandates businesses to secure and properly dispose of sensitive personal information
in a consumer's credit report
Red Flag Rules requires financial institutions and creditors to implement a written
identity theft prevention program
✔✔Texas Privacy Laws (Texas HIPAA) - ✔✔Under the Texas law, covered entities
(health care providers, health insurers, and health clearinghouses) must provide
customized employee training regarding the maintenance and protection of electronic
protected health information (PHI). Covered entities are required to tailor the employee
training to reflect the nature of the covered entity's operations and each employee's
scope of employment as they relate to the maintenance and protection of PHI. New
employees must complete the training within 60 days of hire and all employees must
complete training at least once every two years. Covered entities must maintain training
attendance records for all employees.
The Texas law requires covered entities to provide patients with electronic copies of
their EHR within fifteen days of the patient's written request for the records. This
provision of the Texas law reduces the timeframe a covered entity has to produce EHR
following a patient's request from thirty days under HIPAA. The law charges the Texas
Health and Human Services Commission with establishing a standard format for
releasing patient EHR that is consistent with federal laws.
HB 300 also requires the Texas Attorney General (AG) to establish and maintain a
website that states and explains patients' privacy rights under Texas and federal law.
The website will list the state agencies that regulate covered entities, and provide the
agencies' contact information and each agency's complaint enforcement process. Under
the new law, the AG must issue an annual report regarding the number and types of
complaints pertaining to patient privacy issues.
✔✔In which service model of cloud computing are applications hosted by the cloud
provider in the cloud and typically accessed by users through a web browser? -
✔✔Software as a Service (SaaS)
✔✔A website's privacy notice clearly states that it will not encrypt sensitive personal
information, and the website operator does not, in fact, encrypt the data. - ✔✔Example
of Unfair Trade Practice because the website operator is not being deceptive but the
potential harm caused by not encrypting the sensitive data clearly outweighs the cost of
providing encryption, a commonplace and inexpensive security control.
✔✔An organization promises to honor opt out requests within 10 days but fails to honor
opt out requests within stated timeframe - ✔✔Example of deceptive trade practice.
, When companies state they will safeguard personal information but fail to do so. A
violation of a promise made in a privacy notice is an example of deceptive trade
practice.
✔✔Deceptive trade practice under FTC Section 5. - ✔✔When companies state they will
safeguard personal information but fail to do so. A violation of a promise made in a
privacy notice is an example of deceptive trade practice.
✔✔3 types of data safeguards - ✔✔Administrative Safeguards.
Physical Safeguards.
Technical Safeguards.
✔✔2 examples of administrative safeguards - ✔✔Incident Management Plan
Privacy Policy
✔✔2 examples of physical safeguards - ✔✔Security Guards for a building
Cable locks for laptops
✔✔Examples of technical safeguards - ✔✔Encryption
Password authentication
smart cards
✔✔Fair Information Practices (FIP) - ✔✔1. Notice and awareness
2. Choice and Consent
3. Access and Participation
4. Integrity and security
5. Enforcement and redress
✔✔Four Models of Privacy Protection - ✔✔Comprehensive Model
Co-regulatory Model
Sectoral model
Self-regulatory Model
✔✔Comprehensive Model - ✔✔Used in the EU, this method of data protection to govern
the collection, use and dissemination of personal information in the public and private
sectors, generally with an official or agency responsible for overseeing enforcement.
✔✔Co-regulatory Model - ✔✔Used in Canada, Australia and New Zealand, this model
emphasizes industry development of enforceable codes or standards for privacy and
data protection, against the backdrop of legal requirements by the government.
✔✔Sectoral Model - ✔✔This framework protects personal information by enacting laws
that address a particular industry sector. In these countries, enforcement is achieved
ANSWERS GRADED A+
✔✔GINA (Genetic Information Nondiscrimination Act) - ✔✔became law on May 21,
2008; its basic purpose is to protect people from discrimination by health insurers and
employers based on genetic information.
Amended: ERISA, SSA, Civil Rights Act
No private right to action
✔✔HITECH impact on healthcare - ✔✔-Provided incentive payments to hospitals and
healthcare providers to adopt health IT.
-"Meaningful Use"- criteria required to be met that demonstrated meaningful use of
electronic health records (EHR). EHR technology must be used to achieve certain
objectives.
✔✔HITECH name - ✔✔Health Information Technology for Economic and Clinical Health
Act
✔✔HITECH Act of 2009 - ✔✔Strengthened HIPPA to address privacy impact on
electronic health records
Breach: must notify individuals within 60 days
if more than 500 people, notify HHS immediately
if 500 or more in same jurisdiction, notify media
Avoid liability for using encryption software
✔✔21st Century Cures Act 2016 - ✔✔Expedite research, quicken drug approval, reform
mental health
Certain biomedial research exempt from FOIA
Researchers can remotely view PHI
info blocking prohibited
certificates of confidentiality for research
can share mental health/substance abuse info with family
✔✔FACTA - Fair and Accurate Credit Transaction Act - ✔✔Amends FCRA to help fight
identity theft
CFPB = authority
Mandates limits on information sharing
Entitles consumers to annual free credit report
,Allows one to place fraud alerts, credit freezes
requires businesses to truncate credit/debit card numbers on receipts
Mandates businesses to secure and properly dispose of sensitive personal information
in a consumer's credit report
Red Flag Rules requires financial institutions and creditors to implement a written
identity theft prevention program
✔✔Texas Privacy Laws (Texas HIPAA) - ✔✔Under the Texas law, covered entities
(health care providers, health insurers, and health clearinghouses) must provide
customized employee training regarding the maintenance and protection of electronic
protected health information (PHI). Covered entities are required to tailor the employee
training to reflect the nature of the covered entity's operations and each employee's
scope of employment as they relate to the maintenance and protection of PHI. New
employees must complete the training within 60 days of hire and all employees must
complete training at least once every two years. Covered entities must maintain training
attendance records for all employees.
The Texas law requires covered entities to provide patients with electronic copies of
their EHR within fifteen days of the patient's written request for the records. This
provision of the Texas law reduces the timeframe a covered entity has to produce EHR
following a patient's request from thirty days under HIPAA. The law charges the Texas
Health and Human Services Commission with establishing a standard format for
releasing patient EHR that is consistent with federal laws.
HB 300 also requires the Texas Attorney General (AG) to establish and maintain a
website that states and explains patients' privacy rights under Texas and federal law.
The website will list the state agencies that regulate covered entities, and provide the
agencies' contact information and each agency's complaint enforcement process. Under
the new law, the AG must issue an annual report regarding the number and types of
complaints pertaining to patient privacy issues.
✔✔In which service model of cloud computing are applications hosted by the cloud
provider in the cloud and typically accessed by users through a web browser? -
✔✔Software as a Service (SaaS)
✔✔A website's privacy notice clearly states that it will not encrypt sensitive personal
information, and the website operator does not, in fact, encrypt the data. - ✔✔Example
of Unfair Trade Practice because the website operator is not being deceptive but the
potential harm caused by not encrypting the sensitive data clearly outweighs the cost of
providing encryption, a commonplace and inexpensive security control.
✔✔An organization promises to honor opt out requests within 10 days but fails to honor
opt out requests within stated timeframe - ✔✔Example of deceptive trade practice.
, When companies state they will safeguard personal information but fail to do so. A
violation of a promise made in a privacy notice is an example of deceptive trade
practice.
✔✔Deceptive trade practice under FTC Section 5. - ✔✔When companies state they will
safeguard personal information but fail to do so. A violation of a promise made in a
privacy notice is an example of deceptive trade practice.
✔✔3 types of data safeguards - ✔✔Administrative Safeguards.
Physical Safeguards.
Technical Safeguards.
✔✔2 examples of administrative safeguards - ✔✔Incident Management Plan
Privacy Policy
✔✔2 examples of physical safeguards - ✔✔Security Guards for a building
Cable locks for laptops
✔✔Examples of technical safeguards - ✔✔Encryption
Password authentication
smart cards
✔✔Fair Information Practices (FIP) - ✔✔1. Notice and awareness
2. Choice and Consent
3. Access and Participation
4. Integrity and security
5. Enforcement and redress
✔✔Four Models of Privacy Protection - ✔✔Comprehensive Model
Co-regulatory Model
Sectoral model
Self-regulatory Model
✔✔Comprehensive Model - ✔✔Used in the EU, this method of data protection to govern
the collection, use and dissemination of personal information in the public and private
sectors, generally with an official or agency responsible for overseeing enforcement.
✔✔Co-regulatory Model - ✔✔Used in Canada, Australia and New Zealand, this model
emphasizes industry development of enforceable codes or standards for privacy and
data protection, against the backdrop of legal requirements by the government.
✔✔Sectoral Model - ✔✔This framework protects personal information by enacting laws
that address a particular industry sector. In these countries, enforcement is achieved
