CIPT Free Practice Test

SCENARIO
Looking back at your first two years as the Director of Personal Information Protection and Compliance for the Berry Country Regional Medical Center in Thorn Bay, Ontario, Canada, you see a parade of accomplishments, from developing state-of-the-art simulation based training for employees on privacy
protection to establishing an interactive medical records system that is accessible by patients as well as by the medical personnel. Now, however, a question you have put off looms large: how do we manage all the
data-not only records produced recently, but those still on hand from years ago? A data flow diagram generated last year shows multiple servers, databases, and work stations, many of which hold files that have not yet been incorporated into the new records system. While most of this data is encrypted, its persistence may pose security and compliance concerns. The situation is further complicated by several long-term studies being conducted by the medical staff using patient information. Having recently reviewed the major Canadian privacy regulations, you want to make certain that the medical center is observing them.
You also recall a recent visit to the Records Storage Section, often termed “The Dungeon” in the basement of the old hospital next to the modern facility, where you noticed a multitude of paper records. Some of these were in crates marked by years, medical condition or alphabetically by patient name, while others were in undifferentiated bundles on shelves and on the floor. The back shelves of the section housed data tapes and old hard drives that were often unlabeled but appeared to be years old. On your way out of the dungeon, you noticed just ahead of you a small man in a lab coat who you did not recognize. He carried a batch of folders under his arm, apparently records he had removed from storage.
Which regulation most likely applies to the data stored by Berry Country Regional Medical Center?

1. A. Personal Information Protection and Electronic Documents Act
2. B. Health Insurance Portability and Accountability Act
3. C. The Health Records Act 2001
4. D. The European Union Directive 95/46/EC

Correct Answer: A

SCENARIO
Please use the following to answer the next question:
Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.
The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.
LBH’s privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.
The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.
What is the best way to minimize the risk of an exposure violation through the use of the app?

1. A. Prevent the downloading of photos stored in the app.
2. B. Dissociate the patient health data from the personal data.
3. C. Exclude the collection of personal information from the health record.
4. D. Create a policy to prevent combining data with external data sources.

Correct Answer: D

Which of these actions is NOT generally part of the responsibility of an IT or software engineer?

1. A. Providing feedback on privacy policies.
2. B. Implementing multi-factor authentication.
3. C. Certifying compliance with security and privacy law.
4. D. Building privacy controls into the organization’s IT systems or software.

Correct Answer: A

Which is NOT a drawback to using a biometric recognition system?

1. A. It can require more maintenance and support.
2. B. It can be more expensive than other systems
3. C. It has limited compatibility across systems.
4. D. It is difficult for people to use.

Correct Answer: A

A vendor has been collecting data under an old contract, not aligned with the practices of the organization. Which is the preferred response?

1. A. Destroy the data
2. B. Update the contract to bring the vendor into alignment.
3. C. Continue the terms of the existing contract until it expires.
4. D. Terminate the contract and begin a vendor selection process.

Correct Answer: B