New Year Sale 2026! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

IAPP CIPT Exam - Topic 4 Question 107 Discussion

Actual exam question for IAPP's CIPT exam
Question #: 107
Topic #: 4
[All CIPT Questions]

SCENARIO

Please use the following to answer the next question:

Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app.

The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app.

LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.

The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.

The Privacy Team is conducting a Privacy Impact Assessment (PIA) for the new Light Blue Health application currently in development. Which of the following best describes a risk that is likely to result in a privacy breach?

Show Suggested Answer Hide Answer
Suggested Answer: D

Encryption of Data in Transit: Encrypting health records during transfer is a critical security measure to protect data from interception and unauthorized access. Failure to do so exposes sensitive personal health information to potential breaches.

Privacy Risks: Not encrypting data in transit can lead to significant privacy breaches, especially when dealing with highly sensitive health information. It is essential to use strong encryption methods to secure data during transfer between users' devices and servers.

Reference: The IAPP's documentation on Privacy by Design emphasizes the necessity of encryption for protecting personal data, particularly in healthcare applications where the risk and impact of data breaches are high. Additionally, the Health Insurance Portability and Accountability Act (HIPAA) requires encryption of electronic protected health information (ePHI) in transit to ensure its security and confidentiality.


by Lavera at Jul 08, 2025, 04:19 PM

Limited Time Offer

25%

Off

Get Premium CIPT Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Elena
3 months ago
Totally agree with D! Security should be top priority for health data.
upvoted 0 times
...
Candra
3 months ago
C makes sense too. If they don’t delete data properly, that’s a breach waiting to happen.
upvoted 0 times
...
Rodrigo
3 months ago
I think D is a huge risk. Not encrypting data is a big no-no!
upvoted 0 times
...
Tori
3 months ago
B is definitely a concern. Non-transparent policies can lead to major issues.
upvoted 0 times
...
Aliza
3 months ago
Wait, are they really not encrypting health records? That sounds risky!
upvoted 0 times
...
Twila
4 months ago
Limiting access seems like a good practice, but I don't think option A would lead to a breach. I lean towards option D as the most critical risk based on what we've studied.
upvoted 0 times
...
Tegan
4 months ago
I practiced a similar question about data retention policies, and I think option C could be a valid concern too. If personal data isn't deleted properly, it could lead to unauthorized access.
upvoted 0 times
...
Crissy
4 months ago
I'm not entirely sure, but I feel like option B could also be a risk. If the policies aren't clear, users might not understand what data is being collected.
upvoted 0 times
...
Twana
4 months ago
I remember we discussed the importance of data encryption in our last class. I think option D might be the right choice since not encrypting data could lead to serious breaches.
upvoted 0 times
...
Brynn
5 months ago
I feel pretty confident about this question. The scenario lays out the key privacy concerns pretty clearly, like the app potentially collecting more data than needed or not properly deleting user data. I'll focus on those main risks in my response.
upvoted 0 times
...
Yuriko
5 months ago
This is a tricky one. There are a lot of moving parts with the different teams involved and the privacy policies. I'll need to think through all the potential privacy risks and make sure I cover the most critical ones.
upvoted 0 times
...
Stephanie
5 months ago
Okay, I think I've got a handle on this. The key risk here seems to be the app collecting or using personal data beyond what the user has consented to. I'll make sure to highlight that in my answer.
upvoted 0 times
...
Mila
5 months ago
Hmm, I'm a bit unsure about this one. There are a lot of details to consider, like the different types of data the app is collecting and how it's being used. I'll need to carefully read through the scenario to make sure I understand all the key points.
upvoted 0 times
...
Pamela
5 months ago
This seems like a straightforward privacy assessment question. I'll focus on identifying potential risks that could lead to a privacy breach, like the app collecting more data than necessary or not properly securing the data.
upvoted 0 times
...
Youlanda
7 months ago
Hold up, why isn't there an option for 'All of the above'? That seems like the safest bet to me. Can't be too careful with health data, you know?
upvoted 0 times
...
Johna
7 months ago
I'm voting for C. Letting old data stick around is a surefire way to get into hot water. Delete that stuff ASAP!
upvoted 0 times
Zita
6 months ago
I agree, keeping old data around is definitely risky.
upvoted 0 times
...
...
Norah
7 months ago
I think both not encrypting the health record and having non-transparent policies are important risks to consider in the Privacy Impact Assessment.
upvoted 0 times
...
Chu
7 months ago
B seems like the best answer to me. Unclear policies and terms are a recipe for confusion and potential misuse of data.
upvoted 0 times
...
Glory
7 months ago
I'd go with D. Not encrypting the health records during transfer is a major security vulnerability. That's just asking for trouble.
upvoted 0 times
...
Filiberto
8 months ago
Definitely C. Failing to properly delete personal data is a huge privacy risk that could lead to a breach. Retention policies are crucial.
upvoted 0 times
Nettie
7 months ago
We need to make sure that personal data is securely deleted after it's no longer needed.
upvoted 0 times
...
Princess
7 months ago
I agree, not properly deleting personal data can definitely lead to a privacy breach.
upvoted 0 times
...
Moira
7 months ago
C) Insufficiently deleting personal data after an account reaches its retention period.
upvoted 0 times
...
...
Quentin
8 months ago
That's true, Marta. Non-transparent policies can definitely lead to privacy breaches as well.
upvoted 0 times
...
Marta
8 months ago
But what about including non-transparent policies in the app? That could also be a risk, right?
upvoted 0 times
...
Norah
8 months ago
I agree with Quentin, not encrypting the health record can lead to a privacy breach.
upvoted 0 times
...
Quentin
8 months ago
I think the risk of not encrypting the health record is a big concern.
upvoted 0 times
...

Save Cancel