Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CIPP > Section 2 > Flashcards

Section 2 Flashcards

1
Q

What year was COPPA enacted?

A

1998

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Who does COPPA apply to?

A

Online services that specifically design for children under 13 or know that children under 13 use their services AND online services that knowingly collect children’s personal info from another online service or website targeted at children

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Does COPPA apply to governments and non profits?

A

No except in limited circumstances where nonprofit websites are operated for the commercial benefit of their members

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What additional kinds of PII apply for COPPA?

A

screen names, geolocation data, any media of a child’s image or voice and phone numbers AND any info collected from the child that is combined with any personal information

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What rights do parents have under COPPA?

A

to approve of the collection and use of personal information, to revoke that consent and require the deletion of the information, and to approve of collection ONLY as necessary to use the service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are COPPA’s general requirements?

A

Privacy policy, parental notification, consent and control, information security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What does a COPPA information security program have to have?

A

Reasonable steps to protect against unauthorized access to children’s data and procedures to delete data when it is no longer needed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What must a parental notification of a change in an organization’s practices include under COPPA?

A

The notice must: explain the consent process, detail the information the service intends to collect, and provide a link to the privacy policy and assure that any data collected, including contact data, will be deleted if parental consent isn’t granted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What services must be available to parents under COPPA?

A

To view the personal information collected, revoke any previous consent, restrict the online service form further use of their information and have personal information deleted

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Which agency(ies) enforce COPPA?

A

FTC. It may be enforced by states and some agencies like Department of Transportation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is a COPPA fine?

A

up to $43,280 for each violation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What happened with YouTube and COPPA?

A

In 2019 the FTC got a judgment against YouTube. They weren’t complying with COPPA because they didn’t think they were within its scope because the content is crowdsourced social media and not centrally managed. This helps to affirm COPPA’s application to social media companies.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Who does HIPAA apply to?

A

Health insurance plans, healthcare clearinghouses and healthcare providers
Plus third party businesses associates if they meet certain conditions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are the requirements for third party individuals or organizations under HIPAA?

A

They must have business associate agreements that require the business associate to conform with HIPAA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What kind of records are not covered under HIPAA?

A

personnel records for employees, academic records covered by FERPA, and information that has been properly anonymized so it cannot be used to identify a patient

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are some HIPAA covered transactions from HHS’ guidance that aren’t on their face healthcare information?

A

payment and remittance advice, claims status, eligibility, coordination of benefits, claims and encounter information, enrollment and disenrollment, referrals and authorizations, and premium payments

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What year was the HIPAA privacy rule established?

A

2000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What does the HIPAA Privacy Rule require?

A
  1. implementation of information privacy practices
  2. limits use and disclosure of data without patient authorization
  3. gives patients additional rights including the right to view and correct their medical records
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Who enforces the HIPAA Privacy Rule?

A

HHS Office of Civil Rights (OCR)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

For how long are HIPAA covered entities required to retain records related to their privacy policies (like complaints or public notices)?

A

Six years

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can HIPAA covered entities ask patients to waive their rights under the Privacy Rule as a condition of care or coverage?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are exceptions to the HIPAA requirement that patients have access to their PHI?

A
  1. psychotherapy notes
  2. information gathered for legal actions
  3. lab results specifically restricted by the Clinical Lab Improvement Amendments
  4. circumstances if the entity thinks may cause the person to harm themselves or others
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the exceptions of HIPAA for states to make use of PHI without patient consent?

A
  1. Reporting health information (birth, death records)
  2. Public health (reporting vital stats or enforcing regulations)
  3. Reporting information about health plans for oversight purpose
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the range of fines for the OCR?

A

$100 up to $50K per violation
For repeated violations, up to $1.5M per year (per provision)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Is HIPAA enforcement handled through both civil and criminal?

A

Either or. DOJ handles criminal.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Does the HIPAA Security Rule apply to physical records?

A

No. Only to ePHI.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Does HIPAA preempt state laws?

A

Yes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What was Athens Orthopedic?

A

In 2016 they suffered a large data breach where a hacker stole 208K peoples information. OCR fined them $1.5M in September 2020 and consent resolution for failing to implement required protections that may have prevented the breach.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

When was HITECH passed?

A

2009

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What does HITECH do?

A

provides incentives for healthcare orgs to use EHR and penalties for orgs that don’t use EHR. It also includes the Breach Notification Rule.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Breach Notification Rule factors to determine if a breach has occurred

A
  1. The type of information involved and whether individual patients may be identified.
  2. The parties who used or access the information
  3. The likelihood that PHI was actually shared
  4. How well PHI is secured.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

How long do business associates have to notify healthcare orgs of a breach under the Breach Notification Rule (HITECH)?

A

60 days. Then the covered entity is responsible for the rest of the notifications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What are the notification steps for breaches under the Breach Notification Rule (HITECH) for breaches affecting fewer than 500 people?

A

Entities must notify victims with 60 days of discovery and report to HHS annually.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What are the notification steps for breaches under the Breach Notification Rule (HITECH) for breaches affecting more than 500 people?

A

They must tell HHS within 60 days, notify the victims with 60 days AND notify media outlets (usually in the form of a press release).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Do covered entities have to be able to prove they fulfilled notification requirements under the HITECH Act?

A

Yes. They must keep the documentation.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What are the three types of use and disclosures that are not subject to the Breach Notification Rule?

A
  1. Employee of a covered entity or BA accidentally accesses PHI but was acting in good faith
  2. More than one person authorized to access the same PHI accidentally share with one another
  3. If the entity has good reason to believe that no unauthorized parties will be able to retain the information (example - the data was fully encrypted and there was no way the information could be viewed).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How does HITECH affect BAs?

A

Makes them directly subject to HIPAA so OCR can pursue enforcement actions directly against the BAs

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

How does HITECH affect HIPAA fines?

A

Increases annual violation fines up to $1.5M

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

How does HITECH affect the HIPAA Privacy Rule?

A
  1. requires individual authorization for use of PHI in marketing
  2. provides the ability for individuals to revoke authorizations for disclosure
  3. requires healthcare orgs to maintain records of any PHI disclosures that may be viewed by patients upon request.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

When was the 21st Century Cures Act passed?

A

2016

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What does the 21st Century Cures Act do?

A
  1. Penalizes information blocking
  2. Sets up a framework for sharing certain mental health and substance abuse treatment information for adults with family or caregivers
  3. Adds privacy protections for people participating in medical research (but exempts federal govt research that could identify an individual in a FOIA request)
  4. Gives research participants “certificates of confidentiality” issued by the NIH
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

What entities are subject to “Part Two” (Confidentiality of Substance Use Disorder Patient Records Rule)?

A

Any substance abuse treatment program that receives federal funding

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

When was the Confidentiality of Substance Use Disorder Patient Records Rule passed?

A

1975

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are the consequences of violating the Confidentiality of Substance Use Disorder Patient Records Rule?

A

Fines up to $500 for first offense, and $5K for repeat. Violators may also be subject to criminal prosecution.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What kind of data is covered by the Confidentiality of Substance Use Disorder Patient Records Rule?

A

Any records related to alcohol or substance abuse treatment that could possibly identify an individual patient. It also restricts information that may expose a patient to criminal charges.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

When was the FCRA passed?

A

1970

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What entities are subject to the FCRA?

A

Entities that sell consumer reports and entities that use those reports to make decisions

48
Q

What is a consumer report?

A

Reports furnished to a customer for the purpose of making decisions about an individual related to extending credit, insurance coverage or employment, for a fee

49
Q

What types of information would make something a consumer report?

A

Creditworthiness
Credit standing
Credit capacity
Character
General reputation
Personal characteristics
Mode of living

50
Q

What rights does the FCRA confer to consumers?

A

The right to request access to their consumer report (including credit scores) and to be told if anything in the report has been used to make unfavorable decisions
The right to give consent before reports may be shared with employers, to implement security freezes and to seek damages from businesses that violate their rights

51
Q

What information must be provided in a notice of an unfavorable decision from a consumer report?

A
  1. Contact info for the CRA
  2. An explanation that the CRA only furnished the information and did not play a decision-making role
  3. An explanation of consumer rights (right to access and dispute)
52
Q

When can a consumer report be shared without that person’s written consent?

A
  1. In response to court orders
  2. To review a consumer’s application for insurance underwriting or financial services, such as a credit card
  3. When the information is needed to complete a transaction initiated by the consumer
  4. To evaluate a consumer’s existing accounts or services to verify ongoing eligibility
  5. To review a consumer’s application for certain government licenses or benefits where financial responsibility is a legal criterion
  6. for use by prospective investors and insurers to evaluate risk when deciding whether to invest in consumer debt
  7. For use in setting appropriate levels of child support payments
  8. For use by insurance and credit firms to screen consumers in advance of offering products and services
53
Q

Who enforces the FCRA?

A

FTC, CFPB and states’ attorneys general

54
Q

When was FACTA passed?

A

2003

55
Q

What did FACTA do?

A

Give consumers a right to a free credit report every year, allows consumers to place fraud alerts on their credit reports, require potential creditors to verify an applicant’s ID before extending credit, gives consumers rights to trigger investigation into dispute data by the CRA
It also requires merchants to partially mask credit card numbers on receipts and transaction records and SSNs to be partially redacted (by consumer request)
Requires higher standard and more disclosures from CRAs
Clarifies the FACTA preemption rules, exempts certain communications involving employers, further protects medical information and creates an entity to offer educational programs for financial literacy

56
Q

What wear was the GLBA passed?

A

1999

57
Q

What businesses are subject to the GLBA?

A

Businesses that are “significantly engaged” in offering financial services

58
Q

What is the GLBA Privacy Rule?

A

Businesses must share their privacy notice when beginning a customer relationship and each year after

59
Q

How does GLBA differentiate between customers and consumers?

A

Customer - businesses must provide full privacy notices with all details listed in GLBA (beginning of relationship and annually)
Consumer - businesses must provide only a summary privacy notice that includes instructions for finding the full notice

60
Q

What is the GLBA Safeguards Rule?

A

Info security programs must have designated personnel, assess risk on an ongoing basis and put controls in place to minimize those risks and assess third party partners

It also offers guidance for lowering risk and emphasizes: (1) workfroce training, (2) securing information systems and (3) ongoing monitoring

61
Q

What is the Red Flags Rule?

A

Obligates financial institutions or any creditor to proactively monitor consumer data for identify theft by watching for “red flags”

62
Q

Who regulates the Red Flag Rule?

A

FTC, CFPB and states
SEC and Commodity Futures Trading Commission added by Dodd-Frank

63
Q

When was the Red Flags Rule enacted?

A

Originally in 2003 under FACTA
Expanded to SEC + CFTC under Dodd-Frank

64
Q

When was Dodd-Frank enacted?

A

2008

65
Q

What did the Dodd-Frank Act do?

A

Expanded UDAAP enforcement right to CFPB
Added Abusive to UDAAP

66
Q

What is an “abusive” act (UDAAP)?

A

Any act that materially interferes with the ability of a consumer to understand a term or condition of a consumer financial product or service

67
Q

When was FERPA enacted?

A

1974

68
Q

What entities does FERPA apply to?

A

Educational institutions that receive federal funding from the US Department of Education (and third parties that maintain that data)

69
Q

What records does FERPA pertain to?

A

Any records maintained by an educational institution that pertain directly to a student

70
Q

What does FERPA exclude from regulation?

A

Law enforcement records and some application data and data collected after a student graduates. Also data from teachers like memory aids and individual notes.

71
Q

When can FERPA records be shared?

A

If they are sufficiently anonymized or the student/parent agrees or if there is a “legitimate educational interest”

72
Q

What contract language is important for FERPA regulated entities?

A

Educational institutions will designate tech providers as “school officials” so they can make that third party effectively part of the school and transfer records and so they are subject to FERPA

73
Q

When was the TCPA enacted?

A

1991 and updated in 2012 to add authority for regulating autodialers and robocalls

74
Q

What is the TSR and when was it enacted?

A

Telemarketing Sales Rule - 1995

75
Q

Does the TSR apply to financial institutions?

A

Not technically because it was enacted under the FTC which does not regulated financial institutions. However, the FCC, has jurisdiction over all telemarketing activities and adopted the TSR into its own rules.

76
Q

Who does the Established Business Relationship Exemption apply to?

A

Customers that have completed a purchase or transaction with the company within the last 18 months

77
Q

What are the TSR rules?

A

Calls can only be between 8AM and 9PM
Must use a valid caller ID
Must connect consumers to live person within two seconds
Can only use automated calls with direct written permission of the recipient
Establishes the DNC registry

78
Q

What is the TSR Safe Harbor?

A

Calls made by accident so long as they can show the call was truly an accident, there are DNC procedures and employee training, the company maintains a list of DNC numbers, and their is an internal monitoring process

79
Q

What calls do not apply to the Do Not Call registry?

A

Some calls by political groups, charities, some nonprofit orgs and surveys

80
Q

How often do telemarketers have to update their internal DNC list?

A

Every 31 days

81
Q

Why is the Globex Telecom (2020) enforcement action significant?

A

Globex was using VoIP. It shows that the FTC has ability to enforce regulations even if the technology to make the calls has changed.

82
Q

What was the DNC fines?

A

Up to $43,280 per call (which comes from the FTC Act). States can fine up to $25K per call.

83
Q

When was the Junk Fax Prevention Act enacted?

A

Added to the TCPA as an amendment in 2005

84
Q

When was CAN-SPAM enacted?

A

2003

85
Q

What does CAN-SPAM regulate?

A

Commercial electronic messages (based on primary purpose of the message). Both companies and individuals are subject to the law.

86
Q

Is there an individual private right of action under CAN-SPAM?

A

No

87
Q

What are the CAN-SPAM requirements for unsubscribing?

A

Every message must have a clear notice about how to opt-out. That right must be available for up to 30 days after sending the message. The company must comply within 10 days of a user opting out. Companies cannot sell email addresses of users that have opted out.

88
Q

Does CAN SPAM preempt state laws?

A

Yes. It does not allow states to have stricter rules.

89
Q

When was the Telecommunications Act passed?

A

1996

90
Q

What does the Telecommunications Act regulate?

A

CPNI (customer proprietary network information)

91
Q

Who does the CPNI apply to?

A

Telecommunications carriers (including VoIP)

92
Q

Are text messages regulated by CPNI?

A

No

93
Q

How long does a telecoms company have to notify law enforcement of a breach of their CPNI?

A

7 days

94
Q

When was the Cable Communications Policy Act enacted?

A

1984

95
Q

Are modern streaming services subject to the Cable Communications Policy Act?

A

Not usually. They don’t meet the definition of “providing cable service.”

96
Q

Does the Cable Communications Policy Act provide a private right of action?

A

Yes

97
Q

When was the Video Privacy Protection Act (VPPA) enacted?

A

1988

98
Q

Does the VPPA apply to streaming services?

A

Yes via court interpretation

99
Q

Does the VVPA provide a private right of action?

A

Yes

100
Q

Does the VVPA preempt state law?

A

Yes only if a state law allows or even require MORE disclosure than is permitted by the VPPA. State laws can enforce stricter protections against disclosure of PII.

101
Q

Can the FTC make regulatory actions against non-profits?

A

No. It is exclusive to commerce.

102
Q

What happened in the Wyndham 2015 FTC case?

A

Landmark case that established the FTC had authority to implement security rules.
Wyndham’s security practices led to breach of consumer credit card numbers.

103
Q

What is the FTC “sunset” policy?

A

Sets a 20 year maximum length for a consent decree

104
Q

Google & YouTube COPPA Agreement

A

Notable because
1. $170M fine for Google
2. FTC published guidelines to show how they will determine if a site is directed toward children

105
Q

How does HHS distinguish between entities that provide tracking and cookies for HIPAA covered entities?

A

If the webpage authenticates users, the information is PHI and the service is a business associate.

106
Q

Can credit reports be oral?

A

Yes

107
Q

What are the damages available to consumers under the FCRA?

A

Actual damages
Punitive damages
Legal costs

108
Q

What is the other name for the GLBA?

A

Financial Services Modernization Act of 1999

109
Q

What data does the CCPA exclude?

A

Data collected under the GLBA

110
Q

Which states have GLBA exemptions?

A

California
Colorado
Nevada
Virginia

111
Q

What are abusive practices?

A
  1. Materially interfere with ability of consumer to understand a term or condition OR
  2. Takes unreasonable advantage of: lack of consumer understanding or inability to protect interests or reasonable reliance on providers to act in the interest of the consumer
112
Q

Who has the rights under FERPA if a student is under 18 and enrolled at a postsecondary school? (student or parent)

A

The student

113
Q

What is a transactional relationship that is excluded from the CAN SPAM Act

A
  1. Facilitates or confirms a transaction
  2. Provides warranty, recall, safety or security information
  3. Gives information about change sin terms of an existing account
  4. Provides information about the employment relationship
  5. Delivers goods or services
114
Q

What are the CAN SPAM rules?

A
  1. Don’t use false or misleading header information
  2. Don’t use deceptive subject lines
  3. Identify the message as an advertisement
  4. Tell recipients where you are located
  5. Provide opt-out instructions
  6. Honor opt-out requests promptly
  7. Monitor what others are doing on your behalf
115
Q

What are the GAPP principles?

A
  1. Management
  2. Notice
  3. Choice and consent
  4. Collection
  5. Use, retention and disposal
  6. Access
  7. Disclosure to Third Parties
  8. Security
  9. Quality
  10. Monitoring and Enforcement
116
Q
A

CIPP (5 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions