35. Which of the following purposes for disclosure under HIPAA do not require separate, specific consent from a patient prior to disclosure, assuming you have received prior authorization at the beginning of the client relationship? A. Payment. B. Treatment C. Operations D. All may be disclosed assuming proper authorization at the beginning of the client relationship. 36. In Professor Heck's most humble of opinions, which of the following federal laws provides the most guidance for any company to model a data governance program from? A. HIPAA B. FCRA C. GLBA D. TCPA. 37. Which of the following is not an example of an administrative safeguard? A. Trainings for staff members on data governance procedures. B. Firewalls. C. A prominently displayed privacy policy. D. A policy and procedure distributed to staff members about proper email usage. 38. Which of the following accounts for more data breaches than any other intrusion method? A. Social engineering techniques. B. Password generating applications. C. Spoofing of biometric identifiers. D. Inadvertent disclosure of personal identifying information. 39. Which of the following can be considered personal identifying information? A. Date of Birth B. IP Address C. Driver's License Number. D. All of the above could be considered personal identifying information. 40. The act of auditing your data to determine the level of financial and reputational and legal harm if improperly disclosed, and then labeling the data according to its risk level is called what? A. Data classification. B. Data mapping. C. Data examining. D. Data mining.