Question bank
Certified Information Privacy Professional/US
41 Certified Information Privacy Professional/US questions with the correct answer and a written explanation, organised across 5 exam domains.
- 41 questions
- 5 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Government and Court Access
8 questions in this domain
- Question 1Single Choice
Which two types of entities does HIPAA directly regulate?
- ACovered Entities and Business AssociatesCorrect answer
- BAll employers and state agencies
- CAll organizations holding health data
- DAny entity that processes health information
Why this is the answer
HIPAA applies specifically to Covered Entities and Business Associates, not to all holders of health data.
- Question 2Multiple Select
Which of the following statements about HIPAA and health data are true? (Select all that apply.)
- AHIPAA applies only to Covered Entities and Business Associates.Correct answer
- BHIPAA applies to all health data regardless of the entity holding it.
- CNot all health data is necessarily subject to HIPAA.Correct answer
- DHIPAA applies to any organization that creates health records.
Why this is the answer
HIPAA is not a blanket health-data law; it only covers Covered Entities and Business Associates.
- Question 3Interactive
Based on the scenario in the code block, which organization is most likely a Business Associate under HIPAA?
- AOrganization A
- BOrganization BCorrect answer
- COrganization C
- DNone of the above
Why this is the answer
A Business Associate performs services for or on behalf of a Covered Entity and creates, receives, or transmits protected health information; Organization B fits that role.
- Question 4Single Choice
Which federal agency has broad consumer protection authority over privacy practices?
- AFederal Trade CommissionCorrect answer
- BSecurities and Exchange Commission
- CState Attorney General
- DCovered Entities
Why this is the answer
The FTC is a federal regulator with broad consumer protection authority over privacy practices.
- Question 5Multiple Select
Which of the following are common traps when analyzing U.S. privacy laws? (Select all that apply.)
- AConfusing privacy with securityCorrect answer
- BApplying HIPAA to all health dataCorrect answer
- CAssuming the FTC is the only federal privacy regulatorCorrect answer
- DOverlooking state attorneys general enforcementCorrect answer
Why this is the answer
The playbook flags all of these as common traps for privacy professionals.
- Question 6Interactive
Based on the code block, which company is subject to the SEC's disclosure authority?
- AAlpha CorpCorrect answer
- BDelta Corp
- CBoth companies equally
- DNeither company
Why this is the answer
The SEC regulates disclosures by publicly traded companies regarding privacy and cybersecurity risks, so it is most relevant to Alpha Corp.
- Question 7Single Choice
The SEC's role in privacy regulation is best described as which of the following?
- ADisclosures by publicly traded companies regarding privacy and cybersecurity risksCorrect answer
- BGeneral privacy enforcement for all businesses
- CHealth data privacy enforcement for covered entities
- DState-level privacy law enforcement
Why this is the answer
The SEC oversees public company disclosures involving privacy risks; it is not a general privacy regulator.
- Question 8Multiple Select
Which statements about the FTC's privacy enforcement authority are true? (Select all that apply.)
- AThe FTC is a federal privacy regulator with broad consumer protection powers.Correct answer
- BThe FTC is the only federal privacy regulator.
- CState attorneys general also enforce privacy rights.Correct answer
- DThe SEC has primary authority over consumer privacy.
Why this is the answer
The FTC is one of several regulators; State AGs and sector-specific bodies like the SEC also play roles.
Limits on Private-Sector Collection and Use
8 questions in this domain
- Question 9Single Choice
Which of the following types of organizations are directly subject to the privacy rules imposed by HIPAA?
- ACovered entities and business associatesCorrect answer
- BAll organizations handling health information
- COnly hospitals and physicians
- DAll federal agencies
Why this is the answer
HIPAA applies to covered entities and their business associates, not to every organization that touches health data.
- Question 10Multiple Select
Which of the following statements about HIPAA and health data are correct under U.S. privacy law?
- AHIPAA applies only to covered entities and business associates.Correct answer
- BHIPAA applies to all health data regardless of who holds it.
- CA non-covered entity that handles health data is not directly regulated by HIPAA.Correct answer
- DHealth data held by a covered entity may be subject to HIPAA.Correct answer
Why this is the answer
HIPAA's privacy protections depend on the entity type. The rules cover covered entities and business associates, not every health-data holder.
- Question 11Interactive
Use the scenario in the code block to choose the correct conclusion about how HIPAA applies.
- AHIPAA does not apply because the company is neither a covered entity nor a business associate.Correct answer
- BHIPAA applies because health-related data is involved.
- CHIPAA applies because the company is a business associate by default.
- DHIPAA applies because the FTC requires it.
Why this is the answer
HIPAA coverage depends on whether an entity is a covered entity or business associate, not merely on the type of data processed.
- Question 12Single Choice
Which federal agency has broad authority to take action against unfair or deceptive privacy practices?
- AFTCCorrect answer
- BSEC
- CHHS
- DFCC
Why this is the answer
The FTC uses its consumer protection authority to challenge unfair or deceptive practices involving privacy.
- Question 13Multiple Select
Which statements about FTC privacy enforcement are true?
- AThe FTC has broad consumer protection authority over privacy practices.Correct answer
- BThe FTC is the only federal regulator that can address privacy.
- CThe FTC may challenge practices that are unfair or deceptive.Correct answer
- DState attorneys general also have a role in privacy enforcement.Correct answer
Why this is the answer
FTC authority is broad but not exclusive; state AGs and other agencies also enforce privacy obligations.
- Question 14Interactive
Use the code block scenario to determine which regulator is most likely to act.
- AFTCCorrect answer
- BSEC
- CState Department
- DNone of the above
Why this is the answer
A company that contradicts its posted privacy policy may be liable for a deceptive practice, which the FTC can enforce.
- Question 15Single Choice
Why are state attorneys general significant in U.S. privacy enforcement?
- AThey enforce state privacy laws and can bring actions against violators.Correct answer
- BThey only enforce federal privacy laws.
- CThey have no authority over privacy matters.
- DThey replace FTC enforcement.
Why this is the answer
State AGs enforce state privacy and consumer protection laws, making them important even in a federal-centric view.
- Question 16Multiple Select
Which statements about privacy regulators in the United States are correct?
- AThe SEC regulates disclosures related to privacy and security risks for public companies.Correct answer
- BThe FTC is the only federal agency involved in privacy.
- CState attorneys general are part of U.S. privacy enforcement.Correct answer
- DThe FTC has broad authority over unfair and deceptive practices.Correct answer
Why this is the answer
Several federal and state regulators share privacy enforcement. The SEC handles disclosure issues, while the FTC addresses consumer protection.
State Privacy Laws
10 questions in this domain
- Question 17Single Choice
According to the playbook, which statement best describes the relationship between privacy and security in U.S. law?
- ARelated but distinct conceptsCorrect answer
- BIdentical legal concepts
- CSecurity replaces privacy
- DPrivacy replaces security
Why this is the answer
Privacy and security are related but distinct. Laws like HIPAA include specific mandates for both, so the terms should not be confused.
- Question 18Multiple Select
Which statements correctly describe the scope of HIPAA according to the playbook?
- AApplies to Covered EntitiesCorrect answer
- BApplies to Business AssociatesCorrect answer
- CExtends to all health data
- DFocuses only on security
Why this is the answer
HIPAA applies only to Covered Entities and Business Associates. It does not cover all health data and is not limited to security.
- Question 19Interactive
Review the policy described in the code block. Based on HIPAA scope, how should this application be assessed?
- ACorrectly appliedCorrect answer
- BOverbroad
- CToo narrow
- DUnrelated
Why this is the answer
Because the organization is a business associate, HIPAA applies. Applying HIPAA to protected health information under these facts is appropriate.
- Question 20Single Choice
According to the playbook, which regulator might be incorrectly viewed as having the FTC’s privacy enforcement role?
- ASECCorrect answer
- BState AGs
- CHHS
- DLocal police
Why this is the answer
A common trap is attributing FTC enforcement authority to the wrong agency, such as the SEC.
- Question 21Multiple Select
Which statements about the FTC as a federal privacy regulator are consistent with the playbook?
- AFTC has broad consumer protection powersCorrect answer
- BFTC is the only federal privacy regulator
- COther agencies also regulate privacyCorrect answer
- DState AGs have no enforcement role
Why this is the answer
The FTC has broad consumer protection authority but is not the only regulator. Other federal agencies and state AGs also enforce privacy.
- Question 22Interactive
Which regulator’s role is reflected by the disclosure excerpt in the code block?
- ASECCorrect answer
- BFTC
- CState AG
- DHHS
Why this is the answer
The SEC regulates disclosures regarding privacy risks, including material privacy matters in corporate filings.
- Question 23Single Choice
According to the playbook, why is a federal-only enforcement view of U.S. privacy law incomplete?
- AState AGs enforce state privacy lawsCorrect answer
- BFederal law always preempts state law
- CState AGs lack enforcement power
- DOnly the FTC regulates privacy
Why this is the answer
State AGs play a significant enforcement role in U.S. privacy law, so ignoring them is a common mistake.
- Question 24Multiple Select
Which options are common traps identified in the playbook’s guidance on U.S. privacy law?
- ATreating privacy and security as the sameCorrect answer
- BApplying HIPAA to every health data holderCorrect answer
- CAssuming the FTC is the only regulatorCorrect answer
- DIgnoring HIPAA for all business associates
Why this is the answer
Confusing privacy and security, overapplying HIPAA, and seeing the FTC as exclusive are traps. Business associates are actually covered by HIPAA.
- Question 25Interactive
Which trap is demonstrated by the health data policy in the code block?
- AApplying HIPAA too broadlyCorrect answer
- BConfusing privacy with security
- CIgnoring state AGs
- DMisidentifying the FTC
Why this is the answer
HIPAA applies only to Covered Entities and Business Associates. Treating all health data as covered is an overbroad application.
- Question 26Single Choice
According to the playbook, which types of entities are directly subject to HIPAA’s obligations?
- ACovered Entities and Business AssociatesCorrect answer
- BAll data processors
- COnly cloud providers
- DOnly state agencies
Why this is the answer
HIPAA’s direct obligations apply to Covered Entities and Business Associates, not every entity that touches health data.
U.S. Privacy Environment
8 questions in this domain
- Question 27Single Choice
Why is 'privacy' not interchangeable with 'security' in U.S. federal law?
- ASeparate legal mandates and statutory requirementsCorrect answer
- BOnly security is addressed by federal law
- CPrivacy is exclusively regulated by states
- DThey impose identical obligations
Why this is the answer
Privacy and security carry distinct legal meanings: privacy addresses collection and use of information, while security addresses protection from unauthorized access. Federal laws often impose separate obligations.
- Question 28Multiple Select
Which statements accurately describe HIPAA's applicability? Select all that apply.
- ACovered Entities and Business AssociatesCorrect answer
- BNot all health data is coveredCorrect answer
- CAny organization holding health data
- DPrivacy and Security Rules are identical
Why this is the answer
HIPAA's rules apply only to covered entities and their business associates; not all health data is within HIPAA's scope, and its privacy and security rules are distinct.
- Question 29Interactive
Refer to the code block. Which categories are directly regulated by the rule shown? Select all that apply.
- ACovered EntitiesCorrect answer
- BBusiness AssociatesCorrect answer
- CAll data processors
- DIndividual employees
Why this is the answer
The code block identifies the two categories directly regulated by HIPAA: covered entities and business associates. Other parties are not automatically subject to HIPAA.
- Question 30Single Choice
Which federal agency has authority to enforce the FTC Act's prohibition on unfair or deceptive acts or practices?
- AFederal Trade CommissionCorrect answer
- BSecurities and Exchange Commission
- CFederal Communications Commission
- DConsumer Financial Protection Bureau
Why this is the answer
Section 5 of the FTC Act gives the Federal Trade Commission authority over unfair or deceptive acts or practices. A common mistake is attributing this power to another federal agency.
- Question 31Multiple Select
Which of the following are common traps in analyzing the U.S. privacy regulatory landscape? Select all that apply.
- AAssuming FTC is the only federal privacy regulatorCorrect answer
- BConfusing SEC role with privacy regulatorsCorrect answer
- COverlooking State Attorneys General enforcementCorrect answer
- DApplying HIPAA to all health dataCorrect answer
Why this is the answer
All listed statements are common traps: the FTC is not the only federal privacy regulator, the SEC's disclosure role is distinct, state AGs are important, and HIPAA does not apply to all health data.
- Question 32Interactive
Based on the code block, which agency has authority over unfair or deceptive acts or practices in commerce?
- AFederal Trade CommissionCorrect answer
- BSecurities and Exchange Commission
- CFederal Reserve Board
- DState Attorneys General only
Why this is the answer
The FTC Act's Section 5 is enforced by the FTC. State attorneys general may have parallel state-law authority, but they do not solely enforce the FTC Act.
- Question 33Single Choice
A start-up that is not a healthcare provider, health plan, or clearinghouse develops a wellness app and collects health-related data directly from consumers. Which statement best describes HIPAA's application?
- AHIPAA does not automatically applyCorrect answer
- BHIPAA applies due to health-related data
- CHIPAA applies only if sold through a health plan
- DHIPAA applies to all mobile health apps
Why this is the answer
Because the start-up is neither a covered entity nor a business associate, HIPAA does not automatically apply merely because the data is health-related.
- Question 34Multiple Select
Which of the following accurately describe the FTC's role in U.S. privacy enforcement? Select all that apply.
- ACan enforce unfair or deceptive privacy practicesCorrect answer
- BIs the only federal privacy agency
- CCan coexist with sectoral regulatorsCorrect answer
- DDoes not address consumer privacy
Why this is the answer
The FTC has broad authority over unfair or deceptive practices and can act alongside sectoral regulators. It is not the only federal privacy regulator and does address consumer privacy.
Workplace Privacy
7 questions in this domain
- Question 35Single Choice
What core difference separates privacy from security in data protection?
- APrivacy governs how personal data is collected and used; security protects data from unauthorized access and breaches.Correct answer
- BPrivacy and security are interchangeable terms for protecting data.
- CSecurity determines whether data may be collected; privacy prevents all data use.
- DPrivacy focuses only on encryption; security focuses only on consent.
Why this is the answer
Privacy concerns appropriate collection and use of personal data, while security concerns safeguards against unauthorized access, disclosure, or loss.
- Question 36Multiple Select
Which types of organizations are directly regulated by HIPAA's specific mandates? Select all that apply.
- ACovered EntitiesCorrect answer
- BBusiness AssociatesCorrect answer
- CAny business that handles health data
- DIndividual patients
Why this is the answer
HIPAA applies to covered entities and their business associates. It does not apply to every organization that handles health data.
- Question 37Interactive
Based on the regulator assignment in the code block, which agency is being invoked?
- AFTCCorrect answer
- BSEC
- CHIPAA
- DState Attorney General
Why this is the answer
The code sets regulator to \"FTC\", representing the Federal Trade Commission and its consumer protection role.
- Question 38Single Choice
Which federal agency is commonly recognized for broad authority over unfair or deceptive privacy practices?
- AFederal Trade Commission (FTC)Correct answer
- BSecurities and Exchange Commission (SEC)
- CState Attorneys General
- DCovered Entities
Why this is the answer
The FTC protects consumers from unfair or deceptive privacy practices and is a major privacy regulator, but not the only one.
- Question 39Multiple Select
Why might the SEC be confused with a privacy regulator? Select all that apply.
- AThe SEC regulates certain disclosures about privacy risks and breaches.Correct answer
- BThe SEC's role is distinct from the FTC's broad consumer-protection mandate.Correct answer
- CThe SEC is the primary regulator for all consumer privacy issues.
- DThe SEC enforces HIPAA requirements.
Why this is the answer
The SEC focuses on disclosures affecting investors, including privacy risks. It is not a general consumer privacy regulator.
- Question 40Interactive
Based on the code shown, which enforcement actor is being called?
- AState Attorney GeneralCorrect answer
- BFTC
- CSEC
- DCovered Entity
Why this is the answer
The code assigns the actor as a state attorney general, highlighting state-level privacy enforcement.
- Question 41Single Choice
What mistake do people make when applying HIPAA to health data?
- AHIPAA applies only to covered entities and business associates.Correct answer
- BHIPAA applies to any company holding health data.
- CHIPAA only applies to state governments.
- DHIPAA applies only to individual doctors, not hospitals.
Why this is the answer
A common trap is applying HIPAA to all health data. HIPAA applies to covered entities and business associates.
Frequently asked questions
Everything about the Certified Information Privacy Professional/US question bank and how to use it.