2.0 Security, Confidentiality and Privacy ISC Practice Quiz

• A. Health plans, health care clearinghouses, and health care providers that transmit health information electronically, these three categories directly handle protected health information as part of their core functions
• B. Any company that uses computers to process business data, since all computerized systems are subject to HIPAA security requirements
• C. Only large hospitals with more than 500 employees, since small health care providers are exempt from HIPAA requirements under the small business exception
• D. Only insurance companies, since HIPAA was enacted solely to address health insurance portability requirements

HIPAA (Health Insurance Portability and Accountability Act of 1996) defines three categories of covered entities: (1) Health plans: companies that provide or pay for medical care, health insurance companies, HMOs, Medicare/Medicaid programs, employer-sponsored health plans; (2) Health care clearinghouses: entities that process non-standard health information into standard electronic formats, medical billing services; (3) Health care providers who transmit health information electronically: physicians, hospitals, pharmacies, nursing homes, and other providers that submit electronic claims or conduct other electronic health transactions. Business Associates (third parties who handle PHI on behalf of covered entities, such as cloud storage providers, billing companies, IT service providers) are also subject to HIPAA under the Business Associate Agreement requirement, though they are a separate category from covered entities.

• A. Purpose limitation, personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes
• B. Data minimization, personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed
• C. Storage limitation, personal data shall be kept in a form which permits identification of data subjects for no longer than necessary
• D. Lawfulness, fairness, and transparency, personal data shall be processed lawfully, fairly, and in a transparent manner

Purpose limitation (GDPR Article 5(1)(b)) is one of the six data processing principles: personal data may be collected only for specific, clearly defined purposes that are communicated to data subjects. Once collected, the data cannot be repurposed for uses incompatible with the original collection purpose without additional legal basis. Example: a company that collects email addresses for order confirmation cannot then use those addresses for marketing campaigns without a separate legal basis (such as consent). Exception: further processing for archiving in the public interest, scientific/historical research, or statistical purposes may be compatible under specific conditions.

• A. A permitted disclosure for payment purposes, sharing PHI with the patient's health plan to obtain payment for treatment is one of the three core permitted uses and disclosures under HIPAA that do not require patient authorization
• B. A HIPAA violation, patient health information can never be shared with any third party without the patient's written authorization, regardless of the purpose
• C. A permitted disclosure only if the patient provides written authorization at each visit and for each specific claim submitted to the insurance company
• D. A violation unless the patient opts out of sharing, HIPAA's Privacy Rule requires patients to affirmatively opt out before their information can be shared for payment purposes

HIPAA's Privacy Rule identifies three core permitted uses and disclosures that do not require patient authorization: (1) Treatment: sharing PHI among health care providers involved in treating the patient, e.g., hospital sharing records with a specialist; (2) Payment: sharing PHI with health plans, clearinghouses, and payers to obtain reimbursement for services, billing, claims submission, eligibility verification, prior authorization; (3) Health Care Operations: activities necessary to run the covered entity, quality assessment, training, audits, business planning, accreditation. The hospital-to-insurance company disclosure for billing is a textbook payment-purpose permitted disclosure. The minimum necessary standard still applies, only the PHI reasonably necessary for the payment purpose should be disclosed.

• A. No, GDPR applies only to companies incorporated in the European Union; US-based companies are exempt regardless of whether they serve EU customers
• B. No, GDPR applies only to EU government agencies and public sector organizations; private companies are subject only to their home country's laws
• C. Yes, but only if the company has a physical office, employee, or server located within the EU
• D. Yes, GDPR applies to any organization, regardless of location, that offers goods or services to individuals in the EU or monitors the behavior of EU residents, giving it extraterritorial reach to this US company based on its EU customer base

GDPR Article 3 establishes two bases for extraterritorial application: (1) Establishment basis (Article 3(1)): applies to processing by organizations established in the EU, regardless of where processing occurs; (2) Targeting basis (Article 3(2)): applies to processing by organizations NOT established in the EU if they: offer goods or services to EU data subjects (regardless of whether payment is required), OR monitor the behavior of EU data subjects within the EU (e.g., behavioral tracking, profiling). The US e-commerce company satisfies the targeting basis, it actively sells to EU customers (offers goods/services to EU data subjects) and processes their personal data in doing so. The company must appoint an EU representative (Article 27), comply with all GDPR principles, establish legal bases for processing, honor data subject rights (access, erasure, portability), and implement data breach notification.

• A. The outsourcing eliminates all PCI DSS compliance requirements for the retailer because the payment processor is fully responsible for all cardholder data security
• B. PCI DSS compliance scope is the same regardless of whether the retailer uses an outsourced payment page, the standard applies equally to all e-commerce merchants
• C. The outsourcing approach increases the retailer's PCI DSS compliance burden because using a third party introduces additional third-party management requirements under all 12 PCI DSS requirements
• D. The retailer's PCI DSS scope is significantly reduced, since cardholder data never enters the retailer's systems, the retailer's cardholder data environment (CDE) is limited and the retailer may qualify for a simplified Self-Assessment Questionnaire (SAQ A or SAQ A-EP)

PCI DSS scope reduction through outsourcing is a deliberate strategy. When card data flows directly from the customer browser to the payment processor's hosted page without touching the merchant's servers: (1) The merchant's Cardholder Data Environment (CDE) is minimized, no card data stored, processed, or transmitted on merchant systems; (2) Scope reduction enables simpler compliance assessment, merchants may qualify for SAQ A (fully outsourced e-commerce, no card data on merchant systems, all processing on compliant third-party) or SAQ A-EP (for merchants with payment page redirects); (3) Fewer systems in scope means fewer controls to implement and test; (4) The merchant still has residual responsibilities: ensuring JavaScript/iframe on its checkout page doesn't capture card data, annual SAQ self-assessment, contractual requirements with the processor. This architectural approach (using iframes, redirects, or payment SDKs hosted by processors) is a common PCI scope reduction technique.

• A. The hospital must execute a Business Associate Agreement (BAA) with the cloud vendor specifying the permitted uses of PHI, required safeguards, breach notification obligations, and the vendor's obligation to comply with applicable HIPAA Security Rule requirements
• B. The cloud vendor must become a licensed health care provider, since only licensed providers may handle electronic health records
• C. The hospital must anonymize all patient data before storing it with the cloud vendor, making HIPAA compliance unnecessary for the vendor
• D. The hospital must obtain individual patient consent before any patient record is stored with the cloud vendor

HIPAA's Business Associate provisions: When a covered entity (hospital) discloses PHI to a vendor that performs services on its behalf, that vendor becomes a 'Business Associate' and must sign a Business Associate Agreement (BAA). Required BAA contents: (1) Permitted uses, the vendor may only use PHI for the purposes specified (backup storage, not marketing or research); (2) Safeguards, the vendor must implement appropriate administrative, physical, and technical safeguards; (3) Subcontractor obligations, if the vendor subcontracts, it must obtain BAAs from its subcontractors; (4) Breach notification, the vendor must notify the covered entity of PHI breaches; (5) Access and return, the vendor must provide access to PHI upon request and return or destroy it at contract termination; (6) Compliance, the vendor must comply with applicable HIPAA Security Rule requirements for ePHI. Major cloud providers (AWS, Azure, GCP, Salesforce) offer BAAs to covered entities.

• A. The company may retain the financial transaction data required by EU tax law despite the erasure request, as GDPR's right to erasure does not apply when retention is necessary for compliance with a legal obligation, but the company should delete all other personal data not required by legal retention obligations
• B. The company must immediately delete all customer data in response to the erasure request, GDPR right to erasure is absolute and overrides all other legal obligations
• C. The company should ignore the erasure request entirely because customers who have completed financial transactions waive their GDPR data rights as a condition of the transaction
• D. The company must delete all data immediately and then reacquire it from EU tax authorities if needed for compliance purposes

The correct GDPR erasure response balances the data subject's rights with legal retention requirements: (1) Assess the erasure request: identify all personal data held about the customer; (2) Apply the legal obligation exception: financial transaction data required by EU tax law (typically 7-10 years depending on member state) cannot be deleted, the legal retention obligation overrides the erasure right for that specific data; (3) Delete non-obligated data: all personal data not subject to a legal retention requirement (marketing preferences, browsing history, non-essential profile data) should be deleted or anonymized; (4) Communicate transparently: inform the customer of which data is being deleted, which data is being retained, and the legal basis for retention; (5) Restrict processing: data retained solely for legal compliance should be restricted from other uses (marketing, profiling) during the retention period. This selective deletion approach honors both the erasure right and legal obligations.

• A. The CPA firm is functioning as a Business Associate performing services on behalf of the covered entity (hospital), the hospital must execute a BAA with the CPA firm before granting access to PHI; alternatively, if the audit can be conducted using a de-identified or limited data set, the PHI exposure can be minimized
• B. CPA firms are exempt from HIPAA because they are licensed financial professionals, and professional licensing creates an automatic exemption from HIPAA Business Associate requirements
• C. The CPA firm automatically becomes a covered entity by accessing PHI, requiring the firm to implement a full HIPAA compliance program equivalent to a hospital's program before the audit can begin
• D. HIPAA does not apply to financial audits of health care entities, auditors have a statutory right to access all records including PHI without compliance requirements

CPA firm audit access analysis: (1) Business Associate determination: the CPA firm is performing audit services on behalf of the hospital (a covered entity); the services require access to PHI (patient billing records); therefore, the CPA firm meets the definition of a Business Associate under HIPAA; (2) Required BAA: the hospital must execute a BAA with the CPA firm before PHI is accessed; (3) CPA firm obligations under BAA: implement appropriate safeguards for PHI received; use PHI only for audit purposes; notify hospital of any breaches; return or destroy PHI at engagement completion; (4) Minimum necessary: the hospital should provide only the PHI reasonably necessary for the audit purpose, using de-identified or summary data where possible; (5) Practical implications: many national CPA firms that audit health care clients have established HIPAA compliance programs and standard BAA templates for exactly this scenario.