CIPP-US Practice Test

CIPP-US Practice Test practice questions, page 8 of 11, with answer review and explanations.

Question 36

A covered entity suffers a ransomware attack that affects the personal health information (PHI) of more than 500 individuals. According to Federal law under HIPAA, which of the following would the covered entity NOT have to report the breach to?

  1. Department of Health and Human Services
  2. The affected individuals
  3. The local media
  4. Medical providers

Question 37

What consumer protection did the Fair and Accurate Credit Transactions Act (FACTA) require?

  1. The ability for the consumer to correct inaccurate credit report information
  2. The truncation of account numbers on credit card receipts
  3. The right to request removal from e-mail lists
  4. Consumer notice when third-party data is used to make an adverse decision

Question 38

Who has rulemaking authority for the Fair Credit Reporting Act (FCRA) and the Fair and Accurate Credit Transactions Act (FACTA)?

  1. State Attorneys General
  2. The Federal Trade Commission
  3. The Department of Commerce
  4. The Consumer Financial Protection Bureau

Question 39

Under the Fair and Accurate Credit Transactions Act (FACTA), what is the most appropriate action for a car dealer holding a paper folder of customer credit reports?

  1. To follow the Disposal Rule by having the reports shredded
  2. To follow the Red Flags Rule by mailing the reports to customers
  3. To follow the Privacy Rule by notifying customers that the reports are being stored
  4. To follow the Safeguards Rule by transferring the reports to a secure electronic file

Question 40

When may a financial institution share consumer information with non-affiliated third parties for marketing purposes?

  1. After disclosing information-sharing practices to customers and after giving them an opportunity to opt in.
  2. After disclosing marketing practices to customers and after giving them an opportunity to opt in.
  3. After disclosing information-sharing practices to customers and after giving them an opportunity to opt out.
  4. After disclosing marketing practices to customers and after giving them an opportunity to opt out.