IAPP CIPP-C Practice Test : Free Online Preparation

Free IAPP CIPP-C Exam Questions

Please use the following to answer the next QUESTION:

You are the chief privacy officer at HealthCo, a major hospital in a large U.S. city in state A. HealthCo is a

HIPAA-covered entity that provides healthcare services to more than 100,000 patients. A third-party cloud

computing service provider, CloudHealth, stores and manages the electronic protected health information

(ePHI) of these individuals on behalf of HealthCo. CloudHealth stores the data in state B. As part of

HealthCo’s business associate agreement (BAA) with CloudHealth, HealthCo requires CloudHealth to

implement security

measures, including industry standard encryption practices, to adequately protect the data. However, HealthCo

did not perform due diligence on CloudHealth before entering the contract, and has not conducted audits of

CloudHealth’s security measures.

A CloudHealth employee has recently become the victim of a phishing attack. When the employee

unintentionally clicked on a link from a suspicious email, the PHI of more than 10,000 HealthCo patients was

compromised. It has since been published online. The HealthCo cybersecurity team quickly identifies the

perpetrator as a known hacker who has launched similar attacks on other hospitals – ones that exposed the PHI

of public figures including celebrities and politicians.

During the course of its investigation, HealthCo discovers that CloudHealth has not encrypted the PHI in

accordance with the terms of its contract. In addition, CloudHealth has not provided privacy or security

training to its employees. Law enforcement has requested that HealthCo provide its investigative report of the

breach and a copy of the PHI of the individuals affected.

A patient affected by the breach then sues HealthCo, claiming that the company did not adequately protect the

individual’s ePHI, and that he has suffered substantial harm as a result of the exposed data. The patient’s

attorney has submitted a discovery request for the ePHI exposed in the breach.

What is the most significant reason that the U.S. Department of Health and Human Services (HHS) might

impose a penalty on HealthCo?

Because HealthCo did not require CloudHealth to implement appropriate physical and administrative

measures to safeguard the ePHI

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and Consumer

Financial institutions must help ensure a customer’s understanding of products and services

Please use the following to answer the next QUESTION

Felicia has spent much of her adult life overseas, and has just recently returned to the U.S. to help her friend

Celeste open a jewelry store in California. Felicia, despite being excited at the prospect, has a number of

security concerns, and has only grudgingly accepted the need to hire other employees. In order to guard

against the loss of valuable merchandise, Felicia wants to carefully screen applicants. With their permission,

Felicia would like to run credit checks, administer polygraph tests, and scrutinize videos of interviews. She

intends to read applicants’ postings on social media, ask QUESTION NO:s about drug addiction, and solicit

character references. Felicia believes that if potential employees are serious about becoming part of a dynamic

new business, they will readily agree to these requirements.

Felicia is also in favor of strict employee oversight. In addition to protecting the inventory, she wants to

prevent mistakes during transactions, which will require video monitoring. She also wants to regularly check

the company vehicle’s GPS for locations visited by employees. She also believes that employees who use their

own devices for work-related purposes should agree to a certain amount of supervision.

Given her high standards, Felicia is skeptical about the proposed location of the store. She has been told that

many types of background checks are not allowed under California law. Her friend Celeste thinks these

worries are unfounded, as long as applicants verbally agree to the checks and are offered access to the results.

Nor does Celeste share Felicia’s concern about state breach notification laws, which, she claims, would be

costly to implement even on a minor scale. Celeste believes that

even if the business grows a customer database of a few thousand, it’s unlikely that a state agency would

hassle an honest business if an accidental security incident were to occur.

In any case, Celeste feels that all they need is common sense – like remembering to tear up sensitive

documents before throwing them in the recycling bin. Felicia hopes that she’s right, and that all of her

concerns will be put to rest next month when their new business consultant (who is also a privacy

professional) arrives from North Carolina.

Based on Felicia’s Bring Your Own Device (BYOD) plan, the business consultant will most likely advise

Felicia and Celeste to do what?

To follow the Safeguards Rule by transferring the reports to a secure electronic file

Free IAPP CIPP-C Exam Questions

Try our Free Demo Practice Tests for Comprehensive CIPP-C Exam Preparation