Free IAPP CIPP-US Actual Exam Questions

In 2012, the White House and the FTC both issued reports advocating a new approach to privacy
enforcement that can best be described as what?

What is an exception to the Electronic Communications Privacy Act of 1986 ban on interception of
wire, oral and electronic communications?

Which jurisdiction must courts have in order to hear a particular case?

Which of the following is an important implication of the Dodd-Frank Wall Street Reform and
Consumer Protection Act?

All of the following organizations are specified as covered entities under the Health Insurance
Portability and Accountability Act (HIPAA) EXCEPT?

SCENARIO
Please use the following to answer the next QUESTION:
Declan has just started a job as a nursing assistant in a radiology department at Woodland Hospital.
He has also started a program to become a registered nurse.
Before taking this career path, Declan was vaguely familiar with the Health Insurance Portability and
Accountability Act (HIPAA). He now knows that he must help ensure the security of his patients’
Protected Health Information (PHI). Therefore, he is thinking carefully about privacy issues.
On the morning of his first day, Declan noticed that the newly hired receptionist handed each patient
a HIPAA privacy notice. He wondered if it was necessary to give these privacy notices to returning
patients, and if the radiology department could reduce paper waste through a system of one-time
distribution.
He was also curious about the hospital’s use of a billing company. He questioned whether the
hospital was doing all it could to protect the privacy of its patients if the billing company had details
about patients’ care.
On his first day Declan became familiar with all areas of the hospital’s large radiology department. As
he was organizing equipment left in the halfway, he overheard a conversation between two hospital
administrators. He was surprised to hear that a portable hard drive containing non-encrypted patient
information was missing. The administrators expressed relief that the hospital would be able to avoid
liability. Declan was surprised, and wondered whether the hospital had plans to properly report what
had happened.
Despite Declan’s concern about this issue, he was amazed by the hospital’s effort to integrate
Electronic Health Records (EHRs) into the everyday care of patients. He thought about the potential
for streamlining care even more if they were accessible to all medical facilities nationwide.
Declan had many positive interactions with patients. At the end of his first day, he spoke to one
patient, John, whose father had just been diagnosed with a degenerative muscular disease. John was
about to get blood work done, and he feared that the blood work could reveal a genetic
predisposition to the disease that could affect his ability to obtain insurance coverage. Declan told
John that he did not think that was possible, but the patient was wheeled away before he could
explain why. John plans to ask a colleague about this.
In one month, Declan has a paper due for one his classes on a health topic of his choice. By then, he
will have had many interactions with patients he can use as examples. He will be pleased to give
credit to John by name for inspiring him to think more carefully about genetic testing.
Although Declan’s day ended with many Questions, he was pleased about his new position.
What is the most likely way that Declan might directly violate the Health Insurance Portability and
Accountability Act (HIPAA)?

What is the main reason some supporters of the European approach to privacy are skeptical about
self- regulation of privacy practices?

Which of the following became the first state to pass a law specifically regulating the practices of
data brokers?

SCENARIO
Please use the following to answer the next QUESTION:
Cheryl is the sole owner of Fitness Coach, Inc., a medium-sized company that helps individuals
realize their physical fitness goals through classes, individual instruction, and access to an extensive
indoor gym. She has owned the company for ten years and has always been concerned about
protecting customer’s privacy while maintaining the highest level of service. She is proud that she
has built long-lasting customer relationships.
Although Cheryl and her staff have tried to make privacy protection a priority, the company has no
formal privacy policy. So Cheryl hired Janice, a privacy professional, to help her develop one.
After an initial assessment, Janice created a first of a new policy. Cheryl read through the draft and
was concerned about the many changes the policy would bring throughout the company. For
example, the draft policy stipulates that a customer’s personal information can only be held for one
year after paying for a service such as a session with personal trainer. It also promises that customer
information will not be shared with third parties without the written consent of the customer. The
wording of these rules worry Cheryl since stored personal information often helps her company to
serve her customers, even if there are long pauses between their visits. In addition, there are some
third parties that provide crucial services, such as aerobics instructors who teach classes on a
contract basis. Having access to customer files and understanding the fitness levels of their students
helps instructors to organize their classes.
Janice understood Cheryl’s concerns and was already formulating some ideas for revision. She tried
to put Cheryl at ease by pointing out that customer data can still be kept, but that it should be
classified according to levels of sensitivity. However, Cheryl was skeptical. It seemed that classifying
data and treating each type differently would cause undue difficulties in the company’s day-to-day
operations. Cheryl wants one simple data storage and access system that any employee can access if
needed.
Even though the privacy policy was only a draft, she was beginning to see that changes within her
company were going to be necessary. She told Janice that she would be more comfortable with
implementing the new policy gradually over a period of several months, one department at a time.
She was also interested in a layered approach by creating documents listing applicable parts of the
new policy for each department.
What is the best reason for Cheryl to follow Janice’s suggestion about classifying customer data?

When may a financial institution share consumer information with non-affiliated third parties for
marketing purposes?

SCENARIO
Please use the following to answer the next QUESTION:
Larry has become increasingly dissatisfied with his telemarketing position at SunriseLynx, and
particularly with his supervisor, Evan. Just last week, he overheard Evan mocking the state’s Do Not
Call list, as well as the people on it. “If they were really serious about not being bothered,” Evan said,
“They’d be on the national DNC list. That’s the only one we’re required to follow. At SunriseLynx, we
call until they ask us not to.”
Bizarrely, Evan requires telemarketers to keep records of recipients who ask them to call “another
time.” This, to Larry, is a clear indication that they don’t want to be called at all. Evan doesn’t see it
that way.
Larry believes that Evan’s arrogance also affects the way he treats employees. The U.S. Constitution
protects American workers, and Larry believes that the rights of those at SunriseLynx are violated
regularly. At first Evan seemed friendly, even connecting with employees on social medi
a. However, following Evan’s political posts, it became clear to Larry that employees with similar
affiliations were the only ones offered promotions.
Further, Larry occasionally has packages containing personal-use items mailed to work. Several
times, these have come to him already opened, even though this name was clearly marked. Larry
thinks the opening of personal mail is common at SunriseLynx, and that Fourth Amendment rights
are being trampled under Evan’s leadership.
Larry has also been dismayed to overhear discussions about his coworker, Sadie. Telemarketing calls
are regularly recorded for quality assurance, and although Sadie is always professional during
business, her personal conversations sometimes contain sexual comments. This too is something
Larry has heard Evan laughing about. When he mentioned this to a coworker, his concern was met
with a shrug. It was the coworker’s belief that employees agreed to be monitored when they signed
on. Although personal devices are left alone, phone calls, emails and browsing histories are all
subject to surveillance. In fact, Larry knows of one case in which an employee was fired after an
undercover investigation by an outside firm turned up evidence of misconduct. Although the
employee may have stolen from the company, Evan could have simply contacted the authorities
when he first suspected something amiss.
Larry wants to take action, but is uncertain how to proceed.
In what area does Larry have a misconception about private-sector employee rights?

How did the Fair and Accurate Credit Transactions Act (FACTA) amend the Fair Credit Reporting Act
(FCRA)?

Which federal act does NOT contain provisions for preempting stricter state laws?

Which of the following types of information would an organization generally NOT be required to
disclose to law enforcement?

Which of the following best describes private-sector workplace monitoring in the United States?