I85PREP
⌘ K
CHP study materials
CHP study resources

CHP practice questions

One question at a time. Build your CHP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Healthcare Privacy Fundamentals and Legal Framework

Which federal law is the primary U.S. statute governing the privacy and security of protected health information held by most health care providers?

  1. The Health Insurance Portability and Accountability Act Correct answer.
  2. The Federal Trade Commission Act
  3. The Americans with Disabilities Act
  4. The Freedom of Information Act

Explanation

HIPAA establishes national standards for protecting individually identifiable health information held by covered entities and their business associates. The other statutes address consumer protection, disability rights, and public access to government records rather than health privacy.

Question 2Healthcare Privacy Fundamentals and Legal Framework

Under HIPAA, which type of organization is a 'covered entity'?

  1. A health care clearinghouse that processes claims Correct answer.
  2. A law firm advising hospitals
  3. A grocery chain with a pharmacy counter
  4. A marketing agency serving clinics

Explanation

HIPAA defines covered entities as health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain transactions. Clearinghouses are expressly included in that definition.

Question 3Healthcare Privacy Fundamentals and Legal Framework

A vendor that creates, receives, or maintains protected health information on behalf of a covered entity is best described as which of the following?

  1. An accounting of disclosures
  2. A minimum necessary recipient
  3. A business associate Correct answer.
  4. A covered entity

Explanation

A business associate performs functions or services involving PHI for a covered entity and must generally enter a business associate agreement. The other terms refer to covered organizations, a disclosure record, or a disclosure principle.

Question 4Healthcare Privacy Fundamentals and Legal Framework

Which of the following is a category of 'individually identifiable health information' under HIPAA?

  1. General medical textbook content
  2. Published clinical trial results without participant data
  3. Aggregated statistics with no personal identifiers
  4. Information that relates to a person's past treatment and identifies the person Correct answer.

Explanation

Individually identifiable health information is health information created or received by a covered entity that relates to a person's health, care, or payment and identifies the individual or could be used to identify them. De-identified and non-personal content falls outside that definition.

Question 5Healthcare Privacy Fundamentals and Legal Framework

Which of the following is one of the three components of the HIPAA Security Rule safeguards?

  1. Administrative safeguards Correct answer.
  2. Licensing safeguards
  3. Marketing safeguards
  4. Financial safeguards

Explanation

The Security Rule organizes required protections into administrative, physical, and technical safeguards. Financial, marketing, and licensing safeguards are not Security Rule categories.

Question 6Healthcare Privacy Fundamentals and Legal Framework

The HIPAA Privacy Rule's 'minimum necessary' standard most directly applies to which activity?

  1. Uses required by law enforcement subpoenas
  2. Treatment communications between clinicians
  3. Disclosures authorized by the patient in writing
  4. Routine uses and disclosures of PHI for non-treatment purposes Correct answer.

Explanation

The minimum necessary standard generally requires covered entities to limit PHI used or disclosed for non-treatment purposes to the least amount needed. Treatment disclosures, patient-authorized disclosures, and certain required disclosures are among the exceptions.

Question 7Healthcare Privacy Fundamentals and Legal Framework

Which right does the HIPAA Privacy Rule give individuals with respect to their protected health information?

  1. The right to approve every employee who views the record
  2. The right to delete all records from the provider's system
  3. The right to request an amendment of their records Correct answer.
  4. The right to set the provider's retention schedule

Explanation

Individuals have rights to access, request amendment, request restrictions, request confidential communications, and receive an accounting of certain disclosures. They do not have rights to delete records, set retention schedules, or approve individual workforce members.

Question 8Healthcare Privacy Fundamentals and Legal Framework

Which of the following is considered a HIPAA identifier that must be removed to de-identify data?

  1. Blood pressure readings
  2. Diagnosis codes
  3. Full-face photographs Correct answer.
  4. Laboratory test names

Explanation

The HIPAA de-identification standard lists identifiers such as names, dates, and full-face photographs that must be removed. Clinical values and codes alone are not identifiers under the safe harbor list.

Question 9Healthcare Privacy Fundamentals and Legal Framework

A hospital emails a patient's lab result to the patient's personal email address at the patient's written request. How is this disclosure best characterized under the Privacy Rule?

  1. A permissible disclosure because the patient authorized the communication Correct answer.
  2. A research use requiring an IRB waiver
  3. An impermissible disclosure because email is never allowed
  4. A sale of PHI requiring separate authorization

Explanation

The Privacy Rule permits disclosures to the individual, including at the individual's request and to a requested address, provided reasonable safeguards are used. Email is not categorically prohibited, and this is not a sale or research activity.

Question 10Healthcare Privacy Fundamentals and Legal Framework

A clinician needs to share PHI with another provider for the patient's ongoing treatment. Which statement best reflects the Privacy Rule?

  1. Disclosure for treatment generally does not require patient authorization Correct answer.
  2. Disclosure for treatment requires an accounting entry and consent
  3. Disclosure for treatment always requires written authorization
  4. Disclosure for treatment is prohibited without a court order

Explanation

The Privacy Rule permits uses and disclosures for treatment, payment, and health care operations without authorization. Treatment disclosures to another provider are therefore generally allowed, subject to other applicable law.

Question 11Healthcare Privacy Fundamentals and Legal Framework

A patient asks a covered entity to restrict disclosure of PHI to a health plan for a service the patient paid for in full out of pocket. What does the Privacy Rule generally require?

  1. The entity must obtain a court order before agreeing
  2. The entity must deny the request and report the patient
  3. The entity may ignore all restriction requests without explanation
  4. The entity must agree to the restriction when the payment is made in full Correct answer.

Explanation

The Privacy Rule requires a covered entity to agree to a restriction request when the disclosure is to a health plan for payment or operations and the service was paid in full out of pocket. Other restriction requests may be denied under specified conditions.

Question 12Healthcare Privacy Fundamentals and Legal Framework

A covered entity discovers a workforce member accessed a celebrity patient's record without a treatment reason. Which action best reflects Privacy Rule compliance?

  1. Delete the audit logs to avoid liability
  2. Post the patient's record online to disclose the breach
  3. Ignore the access because the employee had system credentials
  4. Investigate and apply sanctions consistent with the entity's policies Correct answer.

Explanation

Covered entities must have policies addressing inappropriate access and apply sanctions to workforce members who violate privacy policies. Possessing credentials does not authorize access, and destroying logs or further disclosing PHI worsens the violation.

Question 13Healthcare Privacy Fundamentals and Legal Framework

Under the HIPAA Breach Notification Rule, what is the general deadline for notifying affected individuals after discovery of a breach?

  1. Within 6 months of discovery
  2. Within 1 year of discovery
  3. Within 24 hours of discovery
  4. Within 60 days of discovery Correct answer.

Explanation

Covered entities generally must notify affected individuals without unreasonable delay and no later than 60 days after discovery of a breach. The other timeframes are shorter or longer than the rule requires.

Question 14Healthcare Privacy Fundamentals and Legal Framework

A breach affects 800 individuals in one state. Which notification is generally required in addition to notifying the individuals?

  1. Notification to prominent media outlets in the affected state Correct answer.
  2. Notification to every licensed clinician in the state
  3. Notification to the World Health Organization
  4. Notification to the patient's employer

Explanation

When a breach affects more than 500 residents of a state or jurisdiction, the covered entity must notify prominent media outlets serving that area, in addition to HHS and the individuals. The other recipients are not required by the Breach Notification Rule.

Question 15Healthcare Privacy Fundamentals and Legal Framework

Which of the following best describes the HIPAA Security Rule's scope?

  1. It applies to all public health data
  2. It applies only to paper records
  3. It applies only to oral communications
  4. It applies to electronic protected health information Correct answer.

Explanation

The Security Rule sets standards for protecting electronic protected health information. The Privacy Rule covers PHI in any form, while the Security Rule is specifically directed at electronic PHI.

Question 16Healthcare Privacy Fundamentals and Legal Framework

A covered entity wants to use PHI for a research study in which the researcher is also the treating physician. Which approach is most consistent with the Privacy Rule?

  1. Obtain patient authorization or an IRB or privacy board waiver Correct answer.
  2. Use the data without any review because it is research
  3. Rely on the clinician's employment status alone
  4. Publish identifiable data before approval

Explanation

Research uses and disclosures of PHI generally require patient authorization or a waiver of authorization approved by an IRB or privacy board. Employment status and the research label do not remove the need for review.

Question 17Healthcare Privacy Fundamentals and Legal Framework

Which of the following is a required element of a valid HIPAA authorization for disclosure of PHI?

  1. The insurance policy premium
  2. The patient's social security number
  3. The clinician's license number
  4. A description of the information to be used or disclosed Correct answer.

Explanation

A valid authorization must include core elements such as a description of the information, the purpose, the recipients, an expiration date or event, and the individual's signature. Social security numbers, license numbers, and premiums are not required elements.

Question 18Healthcare Privacy Fundamentals and Legal Framework

A patient requests an accounting of disclosures. Which type of disclosure is generally exempt from the accounting requirement?

  1. A disclosure to a public health authority
  2. A disclosure made for treatment purposes Correct answer.
  3. A disclosure to a coroner
  4. A disclosure required by a court order

Explanation

The accounting requirement generally excludes disclosures for treatment, payment, and health care operations, as well as certain other categories. Disclosures to public health authorities, pursuant to court orders, and to coroners typically must be accounted for.

Question 19Healthcare Privacy Fundamentals and Legal Framework

Which legal concept allows a covered entity to disclose PHI when a patient poses a serious and imminent threat to a person or the public?

  1. The marketing exception
  2. The research exception
  3. The fundraising exception
  4. The serious threat exception Correct answer.

Explanation

The Privacy Rule permits disclosure when necessary to prevent a serious and imminent threat to health or safety, consistent with applicable law and professional standards. Marketing, fundraising, and research provisions address different activities.

Question 20Healthcare Privacy Fundamentals and Legal Framework

A state law provides stronger privacy protections for mental health records than HIPAA. Which standard generally governs?

  1. The stricter state law provision Correct answer.
  2. Neither law applies
  3. The weaker federal provision
  4. Only the federal law applies

Explanation

HIPAA sets a federal floor and generally does not preempt state laws that are more stringent or provide greater privacy protection. In such cases the stricter state requirement applies.

Question 21Healthcare Privacy Fundamentals and Legal Framework

A covered entity uses a cloud vendor to store PHI. What is the most appropriate compliance step?

  1. Require the vendor to become a covered entity
  2. Transfer all liability to the patient
  3. Execute a business associate agreement with the vendor Correct answer.
  4. Prohibit any electronic storage of PHI

Explanation

A covered entity must obtain satisfactory assurances, typically through a business associate agreement, that a vendor handling PHI will appropriately safeguard it. The covered entity cannot shift its compliance obligations to the patient.

Question 22Healthcare Privacy Fundamentals and Legal Framework

An organization wants to apply the HIPAA de-identification safe harbor. Which method is consistent with the rule?

  1. Remove only the patient's name
  2. Replace names with initials
  3. Remove the 18 specified identifiers and have no actual knowledge of re-identification Correct answer.
  4. Encrypt the data and keep the key with the same team

Explanation

The safe harbor requires removal of the 18 listed identifiers and that the entity have no actual knowledge that the remaining information could identify an individual. Removing only names or initials does not satisfy the standard.

Question 23Healthcare Privacy Fundamentals and Legal Framework

A covered entity receives a subpoena for PHI without a patient authorization. What should the entity generally verify before disclosing?

  1. That the patient has no other pending litigation
  2. That the requesting attorney is licensed in another state
  3. That satisfactory assurances of notice to the individual or a protective order are in place Correct answer.
  4. That the records are older than five years

Explanation

For judicial and administrative subpoenas, the Privacy Rule generally requires satisfactory assurances that the individual has been notified or that a qualified protective order has been obtained. The other conditions are not Privacy Rule requirements.

Question 24Healthcare Privacy Fundamentals and Legal Framework

Which situation most likely constitutes a reportable breach under the HIPAA Breach Notification Rule?

  1. A clinician discussing care with the patient
  2. A stolen unencrypted laptop containing PHI Correct answer.
  3. A disclosure made with valid authorization
  4. A properly de-identified dataset

Explanation

A breach is an impermissible use or disclosure that compromises security or privacy, and unencrypted PHI on a stolen device generally triggers notification duties unless a low-probability-of-compromise assessment supports otherwise. Authorized disclosures, treatment communications, and de-identified data are not breaches.

Question 25Healthcare Privacy Fundamentals and Legal Framework

A researcher wants to use a limited data set for a study. What is generally required under the Privacy Rule?

  1. Removal of all dates including year
  2. Full patient authorization for each record
  3. An IRB waiver for every use
  4. A data use agreement with the recipient Correct answer.

Explanation

A limited data set may be used or disclosed for research, public health, or health care operations with a data use agreement, and it may retain certain dates and geographic elements. Authorization or an IRB waiver is not required when a valid data use agreement is in place.

Question 26Healthcare Privacy Fundamentals and Legal Framework

Which federal law established the first national administrative standards for protecting the privacy of individually identifiable health information?

  1. The Health Information Technology for Economic and Clinical Health Act of 2009
  2. The Federal Trade Commission Act of 1914
  3. The Freedom of Information Act of 1966
  4. The Health Insurance Portability and Accountability Act of 1996 Correct answer.

Explanation

HIPAA, enacted in 1996, directed the development of national standards for electronic health care transactions and gave rise to the Privacy and Security Rules. HITECH later strengthened and expanded those HIPAA requirements rather than creating them.

Question 27Healthcare Privacy Fundamentals and Legal Framework

Which entity is generally classified as a covered entity under HIPAA?

  1. A law firm that handles personal injury cases
  2. A health care clearinghouse that processes claims data Correct answer.
  3. A grocery store that sells over-the-counter vitamins
  4. An independent software vendor with no health plan contracts

Explanation

HIPAA defines covered entities as health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with covered transactions. A clearinghouse that converts claims formats fits squarely within that definition.

Question 28Healthcare Privacy Fundamentals and Legal Framework

A state enacts a law requiring HIV status to be reported to public health authorities with stricter confidentiality safeguards than HIPAA provides. A covered entity in that state is subject to both rules. How should it proceed?

  1. Choose whichever rule it prefers, since the two laws conflict
  2. Follow the state law, because HIPAA permits more stringent state privacy laws to remain in effect Correct answer.
  3. Apply only HIPAA and report nothing to public health authorities
  4. Ignore the state law, because HIPAA preempts all state health privacy requirements

Explanation

HIPAA sets a federal floor and expressly preserves state laws that are more stringent or that relate to public health reporting. Where state law provides greater privacy protection, the covered entity must comply with it in addition to HIPAA.

Question 29Healthcare Privacy Fundamentals and Legal Framework

Under the HIPAA Privacy Rule, which of the following is an example of a disclosure that requires prior written patient authorization?

  1. Reporting a gunshot wound to local law enforcement as required by law
  2. Sending a patient's PHI to a marketing firm for a paid promotional campaign Correct answer.
  3. Disclosing PHI to the patient's health plan for payment of a claim
  4. Sharing PHI with another provider for the patient's treatment

Explanation

Uses and disclosures for marketing generally require a valid written authorization, and paid marketing communications are specifically restricted. Treatment, payment, and operations activities and legally required reports fall within permission without authorization.

Question 30Healthcare Privacy Fundamentals and Legal Framework

A covered entity's notice of privacy practices must contain which element to satisfy the Privacy Rule?

  1. A copy of the entity's internal risk analysis
  2. A statement that the entity may contact the patient to raise funds and that the patient may opt out of such communications Correct answer.
  3. A guarantee that no breach will ever occur
  4. A list of every employee authorized to access PHI

Explanation

The Privacy Rule requires the notice to describe uses and disclosures, individual rights, and certain specific statements, including a description of fundraising communications and the individual's right to opt out. Internal operational documents and absolute guarantees are not required notice elements.

Question 31Privacy Program Governance and Administration

Which role in a healthcare privacy program is primarily accountable for approving enterprise-wide privacy policies and allocating the budget for privacy initiatives?

  1. The privacy officer
  2. A senior executive or governing body Correct answer.
  3. The IT security administrator
  4. The compliance analyst

Explanation

Ultimate accountability for program approval and resourcing rests with senior leadership or the governing body, which sets tone at the top. Operational roles execute the program but do not hold enterprise-level approval authority.

Question 32Privacy Program Governance and Administration

A covered entity wants a single document that states its overall commitment to protecting health information and the principles guiding staff behavior. Which artifact best fits this need?

  1. A privacy policy Correct answer.
  2. A data retention schedule
  3. A notice of privacy practices
  4. A business associate agreement

Explanation

A privacy policy articulates the organization's overarching commitments and principles for handling protected information. A notice of privacy practices is a patient-facing disclosure, while contracts and schedules serve narrower operational purposes.

Question 33Privacy Program Governance and Administration

Which metric best demonstrates that a privacy training program is actually changing workforce behavior rather than just reaching people?

  1. The number of employees who completed the course
  2. The rate of privacy incidents attributable to staff error over time Correct answer.
  3. The percentage of staff who passed the final quiz
  4. The total training hours delivered per employee

Explanation

Behavioral outcome measures such as incident rates tied to staff error show whether training reduced risky conduct. Completion, pass rates, and hours measure activity or knowledge but not applied behavior.

Question 34Privacy Program Governance and Administration

An organization is mapping its privacy program to a recognized framework to structure governance activities. Which framework is specifically designed for privacy program management rather than general security controls?

  1. The NIST Cybersecurity Framework
  2. ISO/IEC 27001
  3. PCI DSS
  4. The AICPA Privacy Management Framework Correct answer.

Explanation

The AICPA privacy management framework is built around privacy program management, covering governance, risk, and lifecycle controls. The other options are security- or payment-focused standards not centered on privacy governance.

Question 35Privacy Program Governance and Administration

A privacy office is designing a governance structure for a large hospital system with multiple facilities. Which arrangement best supports consistent privacy decision-making across the enterprise?

  1. The legal department handles all privacy matters case by case
  2. Each facility sets its own privacy rules independently
  3. Front-line managers resolve privacy questions as they arise
  4. A central privacy office sets standards with designated facility coordinators Correct answer.

Explanation

A centralized standard-setting function combined with distributed coordinators balances consistency with local responsiveness. Fully decentralized or ad hoc approaches produce inconsistent practices and gaps in accountability.

Question 36Privacy Program Governance and Administration

What is the primary purpose of a privacy program charter?

  1. To list the specific sanctions for each policy violation
  2. To define the program's authority, scope, and reporting relationships Correct answer.
  3. To record the minutes of privacy committee meetings
  4. To describe how patient data is encrypted at rest

Explanation

A charter establishes the program's mandate, boundaries, and accountability lines so its authority is documented and recognized. Technical controls, sanction details, and meeting records belong in other documents.

Question 37Privacy Program Governance and Administration

During an annual review, a privacy officer finds that a policy references a regulation that has since been amended. What is the most appropriate governance response?

  1. Leave the policy unchanged until the next scheduled review cycle
  2. Remove the policy entirely to avoid citing outdated law
  3. Issue a verbal instruction to staff about the change
  4. Revise the policy to reflect the amendment and document the change Correct answer.

Explanation

Policies must be maintained to reflect current legal requirements, with revisions documented for auditability. Deferring, deleting, or relying on informal communication leaves the organization exposed and undocumented.

Question 38Privacy Program Governance and Administration

Which document typically defines the specific administrative, technical, and physical safeguards an organization will apply to protect health information?

  1. The privacy notice
  2. The consent form
  3. The security policy Correct answer.
  4. The breach log

Explanation

A security policy specifies the safeguards used to protect information confidentiality, integrity, and availability. The other documents serve patient communication, authorization, or incident tracking functions.

Question 39Privacy Program Governance and Administration

A privacy officer needs to demonstrate that the program's risk assessments are performed consistently across departments. Which governance mechanism best achieves this?

  1. Relying on vendor assurances instead of internal assessment
  2. Adopting a standardized risk assessment methodology with defined triggers Correct answer.
  3. Conducting assessments only after an incident occurs
  4. Allowing each department to choose its own assessment method

Explanation

A standardized methodology with clear triggers ensures comparability and completeness of risk assessments across the enterprise. Department-specific methods, reactive timing, and reliance on vendors undermine consistency and oversight.

Question 40Privacy Program Governance and Administration

Which of the following best describes the function of a privacy steering committee?

  1. Handling individual patient complaints on a daily basis
  2. Drafting marketing materials for patient outreach
  3. Providing cross-functional oversight and direction for the privacy program Correct answer.
  4. Performing technical penetration testing of systems

Explanation

A steering committee gives cross-functional oversight, prioritizes initiatives, and aligns the program with organizational strategy. Day-to-day complaint handling, technical testing, and marketing are operational tasks outside its scope.

Question 41Privacy Program Governance and Administration

A hospital's privacy office must ensure that a new telehealth vendor handles patient information appropriately. Which governance step should occur before any data is shared?

  1. Publishing the vendor's name in the annual report
  2. Conducting due diligence and executing a compliant business associate agreement Correct answer.
  3. Scheduling a follow-up review after one year of operation
  4. Adding the vendor to the internal staff directory

Explanation

Vendors that handle protected information require pre-engagement due diligence and a contract that imposes required safeguards and obligations. Administrative or post-hoc steps do not establish the necessary contractual protections.

Question 42Privacy Program Governance and Administration

What is the most appropriate way for a privacy program to demonstrate accountability to regulators and leadership?

  1. Maintaining documented policies, training records, and audit results Correct answer.
  2. Keeping program activities confidential to avoid scrutiny
  3. Reporting only favorable metrics to leadership
  4. Relying on staff assurances that privacy is taken seriously

Explanation

Accountability is demonstrated through documented evidence such as policies, training logs, and audit findings that show the program operates as designed. Informal assurances, secrecy, and selective reporting undermine credibility and oversight.

Question 43Privacy Program Governance and Administration

Which element is essential for a privacy policy to be enforceable within an organization?

  1. Publication only on the external website
  2. Approval by the governing body and communication to the workforce Correct answer.
  3. A statement that the policy is optional guidance
  4. A requirement that staff memorize the policy verbatim

Explanation

Enforceable policies require formal approval establishing authority and communication so the workforce knows the expectations. Optional framing, external-only publication, and memorization requirements do not create enforceability.

Question 44Privacy Program Governance and Administration

A privacy program uses a risk register to track identified privacy risks. Which information is most important to record for each risk to support governance decisions?

  1. The number of pages in the related policy
  2. The likelihood, impact, owner, and mitigation status Correct answer.
  3. The date the organization was founded
  4. The name of the person who first noticed the risk

Explanation

Effective risk registers capture likelihood, impact, an accountable owner, and mitigation status so leadership can prioritize and monitor treatment. Ancillary details do not support risk-based decisions.

Question 45Privacy Program Governance and Administration

Which of the following is an example of a leading indicator for a privacy program?

  1. The total fines paid over the past year
  2. The percentage of new systems that completed a privacy review before launch Correct answer.
  3. The count of complaints closed last month
  4. The number of confirmed breaches in the last quarter

Explanation

Leading indicators measure preventive activities that predict future outcomes, such as privacy reviews completed before deployment. Breach counts, fines, and closed complaints are lagging indicators reflecting events that already occurred.

Question 46Privacy Program Governance and Administration

A privacy officer reports to the chief compliance officer, who in turn reports to the board. What governance principle does this reporting line best illustrate?

  1. Transfer of privacy risk to the board
  2. Independence and escalation of privacy accountability Correct answer.
  3. Delegation of all privacy duties to compliance
  4. Elimination of the need for a privacy committee

Explanation

A reporting line that reaches the board supports independent escalation and ensures privacy accountability is visible at the highest level. It does not eliminate committees, delegate all duties, or shift risk ownership.

Question 47Privacy Program Governance and Administration

Which activity is part of program administration rather than program governance?

  1. Establishing the privacy committee's mandate
  2. Processing and documenting individual access requests Correct answer.
  3. Setting the strategic direction for privacy risk tolerance
  4. Approving the annual privacy budget

Explanation

Administration covers operational execution such as handling and documenting access requests. Strategy, budgeting, and mandate-setting are governance-level functions.

Question 48Privacy Program Governance and Administration

An organization wants to ensure privacy considerations are built into new projects from the start. Which governance mechanism best accomplishes this?

  1. A requirement that staff report concerns after launch
  2. A quarterly newsletter about privacy topics
  3. A privacy review gate embedded in the project lifecycle Correct answer.
  4. A post-implementation audit conducted annually

Explanation

Embedding a privacy review gate in the project lifecycle operationalizes privacy by design and prevents issues from reaching production. Post-hoc audits, post-launch reporting, and newsletters do not intervene early enough.

Question 49Privacy Program Governance and Administration

Which statement best describes the relationship between a privacy program's policies and its procedures?

  1. Procedures state requirements; policies describe how to meet them
  2. Procedures supersede policies in all cases
  3. Policies state requirements; procedures describe how to meet them Correct answer.
  4. Policies and procedures are identical documents

Explanation

Policies articulate mandatory requirements and principles, while procedures provide step-by-step instructions for achieving them. The two serve distinct but complementary functions within the program.

Question 50Privacy Program Governance and Administration

A privacy office discovers that a department has been using an unapproved cloud application to store patient information. What governance action should follow first?

  1. Publish the incident in the annual report
  2. Assess the risk, contain exposure, and address the policy gap Correct answer.
  3. Immediately terminate all employees in the department
  4. Ignore the issue because no breach has been confirmed

Explanation

The first governance response is to assess and contain the risk, then remediate the underlying control gap that allowed unapproved use. Ignoring, mass termination, or premature disclosure are disproportionate or ineffective responses.