Question 1 States' breach notification laws generally:

Provide a private right of action

Require that the media be notified upon breach

Define "personal information," which triggers breach, in differing ways

Provide a precise timeframe for notification

Question 2 Which of the following is not a physical safeguard that covered entities must comply with under HIPAA's Security Rule?

Facility Access and Control

Workstation Security

Device Security

Security Personnel

Question 3 True or False: HIPAA and the Gramm Leach Bliley Act force an outcome rather than a process.

True

False

Question 4 Which of the following statements is false?

Many in the business community support a federal law on privacy.

If you follow information security standards, your organization will not have data breaches.

Under HIPAA, a covered entity must designate a security official who is responsible for developing and implementing its security policies and procedures.

Information security professionals regularly rely on guidelines set forth by bodies like the International Standards Organization regarding how to keep information secure.

Question 5 True or False: You can have security without privacy, but you cannot have privacy without security.

True

False

Question 6 Which of the following is true about the FIP of Minimization as it relates to privacy and security?

Security advocates would likely want less information to be collected than privacy advocates.

Privacy and security advocates would be more or less aligned in their views on Minimization.

A privacy advocate would be concerned with obtaining enough information with which to track a user.

A privacy advocate would seek to limit the collection of information to what is needed for the purpose at hand.

Question 7 Under the Gramm Leach Bliley Act, a covered entity must conduct a risk assessment that:

considers the risks in each relevant area of the entity's operations.

is disseminated to all of the entity's vendors.

must adhere to a long list of specific requirements.

is published for public review.