CIPM: Certified Information Privacy ManagerDemo

Question

With respect to the notification, which of the following is the greatest concern?

A Informing the affected individuals that data from other individuals may have also been affected.
B Collecting more personally identifiable information than necessary to provide updates to the affected individuals.
C Using a postcard with the logo of the vendor who make the mistake instead of your company’s logo.
D Trusting a vendor to send out a notice when they already failed once by not encrypting the database.

Explanation

Collecting a name, email address, and month and year of birth from already identified affected individuals solely to provide updates is unnecessary additional processing of personally identifiable information. Privacy practices require limiting personal information to the minimum necessary for the stated purpose; advertising does not justify collecting those additional identifiers.

Learn more

HHS: HIPAA Privacy Rule—minimum necessary standard

CIPM: Certified Information Privacy ManagerDemo

AstroTutor

Notes

Readiness

QuestionQ280

Community Discussion