Free IAPP CIPP-US Exam Dumps Questions & Answers

SCENARIO
Please use the following to answer the next question:
Miraculous Healthcare is a large medical practice with multiple locations in California and Nevada. Miraculous normally treats patients in person, but has recently decided to start offering telehealth appointments, where patients can have virtual appointments with on-site doctors via a phone app.
For this new initiative. Miraculous is considering a product built by MedApps. a company that makes quality telehealth apps for healthcare practices and licenses them to be used with the practices" branding. MedApps provides technical support for the app. which it hosts in the cloud MedApps also offers an optional benchmarking service for providers who wish to compare their practice to others using the service.
Riya is the Privacy Officer at Miraculous, responsible for the practice s compliance with HIPAA and other applicable laws, and she works with the Miraculous procurement team to get vendor agreements in place. She occasionally assists procurement in vetting vendors and inquiring about their own compliance practices. as well as negotiating the terms of vendor agreements Riya is currently reviewing the suitability of the MedApps app from a pnvacy perspective Riya has also been asked by the Miraculous Healthcare business operations team to review the MedApps' optional benchmarking service. Of particular concern is the requirement that Miraculous Healthcare upload information about the appointments to a portal hosted by MedApps.
Which of the following would accurately describe the relationship of the parties if they enter into a contract for use of the app?

• A.  Miraculous Healthcare would be the covered entity because it is the healthcare provider; MedApps would be a business associate because it is providing a service to support Miraculous.
• B.  MedApps would be the covered entity because it built and hosts the app and all the data.
  Miraculous Healthcare would be a business associate because it only provides its brand on the app.
• C.  Miraculous Healthcare would be a covered entity because it is the healthcare provider; MedApps would also be a covered entity because the data in the app is being shared with it.
• D.  Miraculous Healthcare would be the covered entity because Us name and branding are on the app. MedApps would be a business associate because it Is hosting the data that supports the app

According to Section 5 of the FTC Act, self-regulation primarily involves a company's right to do what?

• A.  Adhere to its industry's code of conduct
• B.  Determine which bodies will be involved in adjudication
• C.  Appeal decisions made against it
• D.  Decide if any enforcement actions are justified

Which of the following most accurately describes the regulatory status ot pandemic contact- tracing apps in the United States?

• A.  Contact tracing is not regulated in the United States.
• B.  Contact tracing is regulated by the U.S. Centers for Disease Control and Prevention (CDC).
• C.  Contact tracing is covered exclusively under the Health Insurance Portability and Accountability Act (HIPAA).
• D.  Contact tracing is subject to a patchwork of federal and state privacy laws

Which of the following is an example of federal preemption?

• A.  The California Consumer Privacy Act (CCPA) regulating businesses that have no physical brick- and- mortal presence in California, but which do business there.
• B.  The U.S. Federal Trade Commission's (FTC) ability to enforce against unfair and deceptive trade practices across sectors and industries.
• C.  The Payment Card Industry's (PCI) ability to self-regulate and enforce data security standards for payment card data.
• D.  The U.S. Controlling the Assault of Non-Solicited Pornography and Marketing (CAN-SPAM) Act prohibiting states from passing laws that impose greater obligations on senders of email marketing.

What was unique about the action that the Federal Trade Commission took against B.J.'s Wholesale Club in 2005?

• A.  It made user consent mandatory after any revisions of policy.
• B.  It was based on matters of fairness rather than deception.
• C.  It made third-party audits a penalty for policy violations.
• D.  It was the first substantial U.S.-EU Safe Harbor enforcement.