Retention policies limit how long data is kept to what the purpose and law require. Permanent retention increases risk, and fixed short periods may breach legal duties.
Question 2 of 10 · Federal Privacy Laws
Which HIPAA records receive extra protection, so most disclosures need specific authorization?
Psychotherapy notes kept separately by a mental health professional need specific authorization for most uses. Billing, scheduling and prescription records are ordinary PHI.
Question 3 of 10 · Government and Court Access to Private-sector Information
Under the Federal Rules of Civil Procedure, what limits the scope of discovery?
Rule 26(b)(1) allows discovery of relevant, nonprivileged matter proportional to the needs of the case. Storage cost, age and custodian count are factors at most, not the standard.
Question 4 of 10 · Workplace Privacy
Under the FCRA, what extra step applies when an employer orders an investigative consumer report based on interviews?
For investigative consumer reports, the employer must disclose the request in writing within three days and tell the person of their right to more information. Labor approval, interviewee releases and fixed destruction are not required.
Question 5 of 10 · State Privacy Laws
Under the CCPA, what distinguishes a service provider from a third party?
A service provider processes data on the business's behalf under a contract with required restrictions; without them, the recipient may be a third party. Location, size and transfer method do not decide the status.
Question 6 of 10 · The U.S. Privacy Environment
Does the Fourth Amendment restrict private companies' data collection?
Constitutional search limits bind government actors. Private companies are governed by statutes, regulations, contracts and torts instead.
Question 7 of 10 · Federal Privacy Laws
Which agency issues and enforces the Red Flags Rule for most non-bank creditors?
The FTC enforces the Red Flags Rule for creditors and financial institutions under its jurisdiction, while banking agencies cover the institutions they supervise. Treasury does not enforce it.
Question 8 of 10 · Government and Court Access to Private-sector Information
What did Riley v. California (2014) require before police search a cell phone seized at arrest?
The Court held that the search-incident-to-arrest exception does not extend to digital data on phones, so police generally need a warrant. Probable cause alone, consent or federal approval are not the rule.
Question 9 of 10 · Workplace Privacy
What does the Family and Medical Leave Act require about medical certifications?
FMLA medical certifications must be kept as confidential medical records, separate from personnel files.
Question 10 of 10 · State Privacy Laws
What is a typical consequence of a state comprehensive privacy law's cure period?
Many state laws give businesses notice and a period to cure violations before enforcement, and several cure periods expire after a set date.
0 of 10
The U.S. Privacy Environment
Federal Privacy Laws
Government and Court Access to Private-sector Information
Workplace Privacy
State Privacy Laws
Which domains cost you the points? Members see a breakdown by domain and a study plan built from it.