Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP-US > Overall Guide 1 > Flashcards

Overall Guide 1 Flashcards

You may prefer our related Brainscape-certified flashcards:
U.S. Geography flashcards
1
Q

List one requirement of the Fair Credit Reporting Act (FCRA) that employers must follow in order to conduct background checks on employees.

A

Notify applicants about the process.

Obtain written authorization from applicants.

If a background screen includes interviews with personal contacts of the applicant to learn more about attributes such as “character” or “mode of living,” then it would be considered an investigative report under the FCRA

Provide certification to the furnisher of background reporting information that they are in full compliance with the FCRA and all other applicable federal and state states, including laws prohibiting discrimination.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is active data collection?

A

The consumer directly fills out forms.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is GLBA?

A

The Financial Services Modernization Act of 1999 is more commonly known as the Gramm–Leach–Bliley Act (GLBA) after the names of the lead lawmakers who sponsored the legislation. The GLBA establishes broad federal regulations that include information privacy and security requirements for the financial services industry.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What categories of information are protected under the Genetic Information Nondiscrimination Act (GINA)?

A

GINA protects personal genetic information, including any information from genetic tests or services, including prenatal health services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is California SB-1 (2003)?

A

Known as the California Financial Information Privacy Act, SB-1 (2003) builds on the Gramm–Leach–Bliley Act (GLBA) by adding additional requirements for financial institutions that operate in California.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the transition management phase of the employment process?

A

Transition management refers to the process of voluntarily or involuntarily ending an employment relationship.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Which federal court has the least superiority and which one has the greatest superiority?

A

In order from lesser to greater superiority: U.S. District Courts, U.S. Circuit Courts of Appeals, U.S. Supreme Court

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

How does the Americans with Disabilities Act (ADA) restrict employers from collecting personal data?

A

To protect job seekers from discrimination based on disability, the ADA prohibits employers from collecting information about disability status for use in hiring decisions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is anonymization?

A

The process of taking personal information and making it impossible to identify the individual to whom the information relates.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What is the Telecommunications Act’s definition of a carrier?

A

Any business that charges a fee for providing telecommunications services to the public

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is eDiscovery?

A

Electronic Discovery, or eDiscovery, is the process of identifying, collecting, preserving, and producing electronic records for legal proceedings.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Give three examples of removable information required by the Safe Harbor deidentification method.

A

Names
Web URLs

Geographic divisions and ZIP codes containing fewer than 20,000 people

The month and day of a person’s birth, death, hospital admission or discharge or the age in years of a person over 89

Telephone numbers

Vehicle identifiers, serial numbers, and license plate numbers

Fax numbers

Device identifiers and serial numbers

Email addresses

Social Security numbers

IP addresses

Medical record numbers

Biometric identifiers

Health plan numbers

Full-face photographs

Account numbers

Certificate/license number

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

When an organization makes an unfavorable decision about a person based on a consumer report, what must the FCRA-required notice to the person include?

A

Contact information for the consumer reporting agency (CRA) that provided the credit report

An explanation that the CRA only furnished the information and did not play a decision-making role

An explanation of consumer rights, including the right to access the credit report, credit score, and to dispute inaccurate information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

List three reasons why we should care about privacy.

A

Privacy is an ethical obligation.

Laws and regulations require privacy protections.

Poor privacy practices reflect poorly on an organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

List three of the 12 high-level requirements of PCI DSS.

A

Install & maintain a firewall

Do not use vendor-supplied defaults

Protect stored cardholder data.

Encrypt cardholder data on open networks.

Use antivirus software.

Develop and maintain secure systems & applications.

Restrict access to cardholder data by need-to-know.

Assign a unique ID to each person with computer access.

Restrict physical access to cardholder data.

Track & monitor all access to network resources & cardholder data.

Regularly test security systems and processes.

Maintain a policy that addresses information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the three key objectives of cybersecurity programs and what do they mean?

A

Confidentiality ensures that unauthorized individuals are not able to gain access to sensitive information.

Integrity ensures that there are no unauthorized modifications to information or systems, either intentionally or unintentionally.

Availability ensures that information and systems are ready to meet the needs of legitimate users at the time those users request them.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

When is information not personal information?

A

First, if the information is not about a person, then it is not personal information. Second, information is not personal information if it does not provide a way to identify the person that the information is about.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is COPPA?

A

COPPA is the federal Children’s Online Privacy Protection Act, which provides special privacy protections for children under the age of 13.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are three primary privacy roles?

A

Data subject, data controllers, data processors

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What kind of information is considered PII?

A

Personally identifiable information (PII) includes any information that uniquely identifies an individual person, including customers, employees, and third parties.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the 10 GAPP principles?

A
  1. Management
  2. Notice
  3. Choice and Consent
  4. Collection
  5. Use, Retention, and Disposal
  6. Access
  7. Disclosure to Third Parties
  8. Security for Privacy
  9. Quality
  10. Monitoring and Enforcement
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is aggregation?

A

The process of summarizing data about a group of individuals in a manner that makes it impossible to draw conclusions about a single person.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Give three examples of key elements that are recommended by NIST in incident response policies

A

Statement of management commitment

Purpose and objectives of the policy

Scope of the policy (to whom it applies and under what circumstances)

Definition of cybersecurity incidents and related terms

Organizational structure and definition of roles, responsibilities, and level of authority

Prioritization or severity rating scheme for incidents

Performance measures for the CSIRT

Reporting and contact forms

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Give three examples of special categories of personal data listed by GDPR.

A

Racial or ethnic origin

Political opinions

Religious or philosophical beliefs

Trade union membership

Genetic data

Biometric data used for the purpose of uniquely identifying a natural person

Health data

Data concerning a natural person’s sex life or sexual orientation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the main purpose of Title VII of the Civil Rights Act?

A

Title VII of the Civil Rights Act protects job seekers and employees from discrimination based on race, color, religion, national origin, religion, or sex.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Give three examples of key differences among state data protection laws today.

A

The definition of personal information, timelines for breach notification, notifications to regulators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the scope of the Cable Communications Policy Act?

A

Cable television system operators

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What does strict liability mean?

A

The strict liability standard says that a person is responsible for the consequences of their actions, even if they could not reasonably anticipate the adverse outcome.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

List three practices organizations may consider to reduce compliance risk related to state-level laws.

A

Clean up Social Security numbers

Implement data retention and destruction practices

Document information security procedures

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What is a data controller under GDPR?

A

A data controller is usually the entity ultimately in charge of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Give three examples of FERPA record types.

A

Grades and transcripts

Class rosters

Course schedules of individual students

Health records for minors

Financial information for higher education students

Disciplinary records

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

In practice, most FTC complaints are not resolved through the formal process but use two other settlement mechanisms. What are they?

A

The FTC and the accused company may decide to informally resolve minor complaints by adjusting the company’s business practices.

In more serious cases, the FTC and the company may enter into a consent decree. This is a formal agreement between the company and the government that dictates how the company will behave moving forward. The company does not admit guilt but enters into a formal, enforceable agreement. If the company later violates the consent decree, the FTC can bring formal legal action against the firm.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Give three examples of principle features of the Foreign Intelligence Surveillance Act (FISA).

A

Authorization for specific forms of surveillance

The Foreign Intelligence Surveillance Court (FISC)

Authority for warrantless surveillance

Surveillance of foreign powers

Surveillance of U.S. persons acting as agents of foreign powers

Minimization principle

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

Give three examples of strategies that have been developed to facilitate international data transfer.

A

Safe harbor programs

Binding corporate rules

Standard contractual clauses

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Why might businesses choose to use third parties to conduct employee misconduct investigations?

A

The use of third parties may be attractive to businesses because they bring additional resources and expertise, knowledge of applicable laws, and the ability to redact irrelevant private information before furnishing reports.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

TrustArc offers the TRUSTe verified privacy seal to websites that complete a three-phase process. What are these three phases?

A

Assessment, Remediation and Certification, Ongoing Monitoring and Guidance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

List all five objectives at the containment, eradication, and recovery phase

A
  1. Select a containment strategy appropriate to the incident circumstances.
  2. Implement the selected containment strategy to limit the damage caused by the incident.
  3. Gather additional evidence as needed to support the response effort and potential legal action.
  4. Identify the attackers and attacking systems.
  5. Eradicate the effects of the incident and recover normal business operations.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is GPEN?

A

In 2007, the Organization for Economic Cooperation and Development (OECD) developed the Global Privacy Enforcement Network (GPEN) and developed the GPEN Action Plan to improve international cooperation in enforcing privacy regulations in member nations.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What is HIPAA?

A

The Health Insurance Portability and Accountability Act (HIPAA) was enacted to improve several aspects of the healthcare system, including the sharing of data among providers and insurers, the process of switching health plans, and the security and privacy of personal health information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What are the five “functions” in the NIST cybersecurity framework?

A

Identify

Protect

Detect

Respond

Recover

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What is the scope of CAN-SPAM?

A

The CAN-SPAM Act regulates all electronic commercial e-mail messages, not only mass email marketing programs. Commercial messages under the act include any advertising messages and promotions for services or products.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What does a private right of action mean?

A

A private right of action means that individuals and corporations may bring cases to court for violations of a specific law.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What kind of information is included in PHI?

A

Protected health information (PHI) includes medical records maintained by healthcare providers and other organizations who are subject to the Health Insurance Portability and Accountability Act (HIPAA).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What is the scope of the Bank Secrecy Act (BSA)?

A

The BSA applies to “financial institutions,” defined broadly to include organizations such as banks, brokerages, jewelers, and even pawnbrokers.

45
Q

What are the four elements of negligence?

A

Duty of care, a breach of that duty of care, damages, causation

46
Q

What are two general forms of liability and when do they occur?

A

Criminal liability occurs when a person violates a criminal law.

Civil liability occurs when one person claims that another person has failed to carry out a legal duty that they were responsible for.

47
Q

What is the purpose of the FCC?

A

The Federal Communications Commission (FCC) is the regulator responsible for interstate and international communications. The agency has the authority to regulate communications that originate or terminate in the United States and that occur over telephone, radio, television, wire, satellite, or cable.

48
Q

What does the organization need to do at the early stages of the data lifecycle?

A

At the early stages of the data lifecycle, organizations should practice data minimization, where they collect the smallest possible amount of information necessary to meet their business requirements.

49
Q

What is CalECPA?

A

The California Electronic Communications and Privacy Act, known as CalECPA, requires California law enforcement agents to obtain warrants in order to search most electronic data generated by Californians.

50
Q

What changed in Tennessee’s SB 2005 in 2016?

A

In 2016, SB 2005 updated Tennessee’s breach notification rules so that encrypted information was no longer automatically excluded from the definition of a breach of personal information.

51
Q

What are three motivating factors for firms to participate in self-regulatory schemes?

A

Genuine desire to protect the security and privacy of sensitive personal information

Competitive interests in preserving the integrity of their industry against unscrupulous practices

Desire to avoid government intervention by preempting possible legislation through self-regulation

52
Q

List five privacy and security requirements under U.S. federal law to protect children’s personal information.

A

Privacy policies, parental notification, parental consent, parental control, information security

53
Q

Why might some states restrict the use of credit history in employment decisions?

A

Using credit histories in employment decisions may unfairly disadvantage people from non-affluent backgrounds.

54
Q

What are three criteria to determine whether a practice is deceptive?

A

There must be a representation, omission, or practice that is likely to mislead the consumer.

The practice must be examined from the perspective of a consumer acting reasonably in the circumstances

The representation, omission, or practice must be material.

55
Q

What does the right to erasure mean?

A

Also known as the right to be forgotten, under the GDPR, EU data subjects have the right to ask data controllers to erase all of their personal data.

56
Q

List four characteristics that differentiate different types of cybersecurity threat actors.

A

Internal vs. External; Level of Sophistication/Capability; Resources/Funding; Intent/Motivation

57
Q

Name at least three phases of the discovery process.

A

Identification

Preservation

Collection

Processing

Review

Production and Presentation

58
Q

What are four major categories of security event indicators described by NIST-800-61?

A

Alerts, logs, publicly available information, people

59
Q

What are abusive practices under the Dodd-Frank Act?

A

An abusive practice is any act that “materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service.”

60
Q

What are three circumstances in which an unauthorized disclosure of personal health information (PHI) may not be considered a breach under HIPAA?

A

If an employee of a covered entity or business associate accidently accesses PHI but was acting in good faith

If more than one person authorized to access the same PHI accidentally share with one another

If the covered entity or business associate has good reason to believe that no unauthorized parties will be able to retain the information

61
Q

List at least five of the nine core principles of the APEC data privacy framework.

A

Preventing Harm

Notice

Collection Limitation

Uses of Personal Information

Choice

Integrity of Personal Information

Security Safeguards

Access and Correction

Accountability

62
Q

What is the third-party doctrine?

A

When certain information is collected by third parties as part of conducting transactions, the privacy of that information is generally not protected by the U.S. Constitution.

63
Q

Name three general requirements of the HIPAA privacy rule.

A

The implementation of information privacy practices

Limits use and disclosure of data without patient authorization

Gives patients additional rights with respect to their medical information, including the right to view and correct their medical records

64
Q

List four of the federal agencies that share responsibility for regulating the financial industry.

A

The Consumer Financial Protection Bureau (CFPB)

The Federal Reserve

The National Credit Union Administration (NCUA)

The Federal Deposit Insurance Corporation (FDIC)

The Office of the Comptroller of the Currency

65
Q

What are the seven foundational principles of Privacy by Design?

A
  1. Proactive, not Reactive; Preventive, not Remedial.
  2. Privacy as the Default Setting.
  3. Privacy Embedded into Design.
  4. Full Functionality – Positive-Sum, not Zero-Sum.
  5. End-to-End Security – Full Lifecycle Protection.
  6. Visibility and Transparency – Keep It Open.
  7. Respect for User Privacy – Keep It User-Centric.
66
Q

What are the two bodies of the U.S. Congress?

A

House of Representatives and Senate

67
Q

What is a data processor under GDPR?

A

A data processor is any entity that handles personal data for the data controller.

68
Q

Give one example of an exception to the Privacy Protection Act (PPA).

A

Situations where law enforcement is investigating a journalist as a suspect in a crime

Cases where an immediate search might be necessary to help law enforcement prevent death or serious injury

Situations where law enforcement has good reason to think that a journalist might destroy or alter important evidence if they receive advance warning

69
Q

Why was the HITECH Act passed?

A

The Health Information Technology for Economic and Clinical Health (HITECH) Act was passed in 2009 in order to improve healthcare by bringing health systems up-to-date with modern technology.

70
Q

What are the four stages of the incident response process?

A

Preparation, Detection and Analysis, Containment Eradication and Recovery, Postincident Activity

71
Q

What is privacy according to GAPP?

A

The rights and obligations of individuals and organizations with respect to the collection, use, retention, disclosure, and destruction of personal information.

72
Q

What does preemption mean?

A

Preemption means that law that stems from a higher authority will take precedence over laws from a lower authority.

73
Q

What are three common features shared by marketing laws in different U.S. states?

A

State Unfair or Deceptive Acts or Practices (UDAP) laws build on the federal framework and definitions established in Section V of the FTC Act.

While the FTC Act sets a nationwide set of requirements and protections, state-level laws add requirements and consumer protections above and beyond those in the FTC Act.

State UDAP laws are usually enforced by state attorneys general.

74
Q

What is the FTC?

A

The Federal Trade Commission (FTC) is an independent agency that exists within the executive branch of the government but also maintains a degree of autonomy from the day-to-day workings of the executive branch.

75
Q

What are four objectives that align with the DOC’s third privacy goal to conduct robust compliance and oversight programs?

A

What are three types of HIPAA-covered entities?

76
Q

Give three examples of information that make something a credit report under the Fair Credit Reporting Act (FCRA).

A

Creditworthiness

Credit standing

Credit capacity

Character

General reputation

Personal characteristics

Mode of living

77
Q

What is a data importer under the GDPR?

A

A non-EU entity that receives personal information on EU data subjects from an EU data exporter

78
Q

Give three types of threat actors that security professionals encounter in their work.

A

Script kiddies, hacktivists, criminal syndicates, advanced persistent threats (APTs), insiders

79
Q

What are four goals that the US Department of Commerce (DOC) has to guide the execution of a privacy program?

A
  1. Foster a culture of privacy and disclosure and demonstrate leadership through policy and partnerships.
  2. Provide outreach, education, training, and reports in order to promote privacy and transparency.
  3. Conduct robust compliance and oversight programs to ensure adherence to federal privacy and disclosure laws and policies in all DOC activities.
  4. Develop and maintain the best privacy and disclosure professionals in the federal government.
80
Q

What is the function of a gag order in an NSL?

A

A gag order legally prohibits the recipient of a National Security Letter, such as an internet service provider (ISP), from disclosing the existence of the government’s order and the contents of the order.

81
Q

List three sources of law.

A

Constitutional law, legislation, administrative law, case law, common law, contract law

82
Q

What is the responsibility of the executive branch?

A

The executive branch of the government is led by the president and is responsible for carrying out and enforcing the laws created by the legislative branch.

83
Q

What are three key parameters of state breach notification rules?

A

Who to notify, when to notify, and how to notify

84
Q

What are three legislative components of the Electronic Communications Privacy Act (ECPA)?

A

Title I: Wiretap Act, Title II: Stored Communications Act (SCA), Title III: Pen Register and Trap and Trace Devices

85
Q

What are four preemployment screening methods mentioned in this book?

A

Personality and psychological evaluations

Polygraph testing

Drug and alcohol testing

Social media

86
Q

What are two elements to a court’s jurisdiction?

A

Personal jurisdiction and subject matter jurisdiction

87
Q

Name three information management processes that typically occur at the end of an employment relationship.

A

Access management

Records retention

Responding to reference requests

88
Q

Give three examples of U.S. agencies regulating workspace privacy.

A

Federal Trade Commission (FTC)

Department of Labor (DOL)

Equal Employment Opportunity Commission (EEOC)

National Labor Relations Board (NLRB)

Occupational Safety and Health Administration (OSHA)

Securities and Exchange Commission (SEC)

89
Q

Under the Right to Financial Privacy Act (RFPA), what are four circumstances in which financial institutions may be authorized to disclose financial records to the federal government?

A

Customer authorization, administrative or judicial subpoena, search warrant, formal written request

90
Q

Name one additional specific power that the president has (identified in the U.S. Constitution).

A

Serving as commander-in-chief of the U.S. military forces

Granting pardons and reprieves for offenses against the United States

Negotiating treaties with other nations on behalf of the United States

Appointing justices to the Supreme Court, ambassadors to foreign nations, and other officers of the federal government

91
Q

What are three factors that the FTC considers when determining whether a trade practice is unfair?

A

Whether the practice injures consumers

Whether the practice violates established public policy

Whether the practice is unethical or unscrupulous

92
Q

Give five examples of data subject rights under the GDPR.

A

Right of access

Right to rectification

Right to restriction of processing

Right of erasure

Notification obligations

Right to data portability

Right to object

Automated individual decision making, including profiling

93
Q

What is personal data defined by the EU’s General Data Protection Regulation (GDPR)?

A

Personal data includes any information that identifies an individual, including a person’s name, location, or any other personally identifiable characteristics.

94
Q

List four major classification categories used by the U.S. government.

A

Top secret, Secret, Confidential, Unclassified.

95
Q

What is typically included in the definition of personal information protected by state breach notification laws?

A

Typically, states define personal information to include social security numbers, financial account numbers, state identification or passport numbers. A person’s full name, or first initial and last name, linked with another piece of identifying information, is usually protected as well.

96
Q

What is personal information according to GAPP?

A

Information that is or can be about or related to an identifiable individual.

97
Q

What is a data exporter under the GDPR?

A

An entity in the EU that shares EU data subjects’ personal information outside of EU member states

98
Q

What are four legal torts that may result in a successful claim of invasion of privacy?

A

The invasion of solitude, the public disclosure of private facts, false light, appropriation

99
Q

What is an event? What is an adverse event? And what is a security incident?

A

An event is any observable occurrence in a system or network.

An adverse event is any event that has negative consequences.

A security incident is a violation or imminent threat of violation of security policies, acceptable use policies, or standard security practices.

100
Q

Determining whether a practice unfairly injures consumers requires the use of a three-pronged test that was documented in a 1980 FTC Policy Statement on Unfairness. What are they?

A

The injury must be substantial.

The injury must not be outweighed by countervailing benefits to consumers and to competition.

The injury must not be reasonably avoidable.

101
Q

Give five examples of technologies that might be used for employee monitoring.

A

Computer usage monitoring

Location-based monitoring

Social media tracking

Biometric tracking

Wellness programs

102
Q

What is a data flow diagram?

A

Serves as artifacts of the work and references for team members seeking to understand how data moves through the organization.

103
Q

What are the five main requirements of COPPA?

A
  1. Privacy Policies
  2. Parental Notification
  3. Parental Consent
  4. Parental Control
  5. Information Security
104
Q

What are NSLs?

A

National Security Letters (NSLs) are a form of administrative subpoena used by the U.S. federal government to order the production of business records related to national security concerns.

105
Q

What are the three branches of the U.S. federal government?

A

Legislative branch, executive branch, and judicial branch

106
Q

What are two deidentification techniques published by HHS to achieve deidentification in accordance with the HIPAA Privacy Rule?

A

Expert determination and safe harbor

107
Q

What is passive data collection?

A

The organization gathers information from the individual automatically when they visit a website or engage in other online activity.

108
Q

What is meant by “theories of liability”?

A

Theories of liability describe the conditions that must be met for someone to be found liable of a crime or civil violation of the law.

CIPP-US (10 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions