Module 3 - Privacy and HIPAA

Question 1

Two laws related to PII

Answer 1

Privacy Act of 1974

HIPAA

Question 2

Privacy Act of 1974 (goals)

Answer 2

1. to limit the amount of information that is recorded,
2. ensure that Federal agencies that collect personal records have the appropriate
   authority,
3. protect the information that is recorded, and
4. give citizens the opportunity to review information and a means to change
   incorrect entries.

Question 3

HIPAA

Answer 3

Health Insurance Portability and Accountability Act

• gave the U.S. Department of Health and Human Services (HHS) the ability to establish privacy regulations.
• The Act was designed to protect health-related information (past, present, and future), which could be used to identify individuals.

Question 4

Other Documents / Guidance Documents (4)

Answer 4

• Appendix J of NIST’s Special Publication 800-53
• Office of Management and Budget (OMB) Memorandum M-03-22
• Executive Office Memorandum 99-18 for posting Privacy policies on the Internet
• The EU Privacy Directive

Question 5

Privacy Act of 1974 (purpose)

Answer 5

response to the creation of databases and the impact on individual privacy

exemptions:
- government law enforcement agencies
- excuse through “routine use” exemption

Question 6

Privacy Act Definitions:
Individual
Maintain
Record
System of Records
Statistical Records
Routine Use
Matching Program
Recipient Agency

Answer 6

10 or more records

Question 7

Privacy Act Accounting for Disclosures

Answer 7

• maintain accounting of: date, nature, and purpose of each disclosure.
• retain for at least five years, or the life of the record

Question 8

Privacy Act Access to Records

Answer 8

• individual can gain access to his record
• permit individual to request amendment of a record
• permit the individual who disagrees

Question 9

System of Records Notice

Answer 9

SORN - Federal Register

Question 10

Agency Requirements

Answer 10

Privacy Officer
Privacy Training
Privacy Act Systems of Records
System of Records Notice (SORN)

Question 11

Privacy Impact Assessment

Answer 11

PIA

Question 12

Certification & Accreditation process

Answer 12

-

Question 13

NIST 800-53 appendix J

Answer 13

Privacy Controls - best practices

risk management

Question 14

Privacy Practices Notice

Answer 14

-