SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.What is the best way to ensure that the application only collects personal data that is needed to fulfill its primary purpose of providing potential medical and healthcare recommendations?
Answer(s): D
Justification (bullet-point format)Correct option – D – Documenting each personal data category collected and linking it to a specific application feature is the most precise control. It forces the development team to map every data element to a legitimate purpose, making any unnecessary collection evident during design review and audit. This “purpose-by-feature” mapping is the core of Privacy-by-Design and directly satisfies the PIA requirement to verify that only data needed for the primary recommendation function is collected.Why A is insufficient – Obtaining consent before analytics is a good baseline, but consent alone does not guarantee that the data collected is limited to what is necessary for the primary function. A user could consent to broad analytics that are unrelated to the medical recommendation purpose, leading to over-collection.Why B is insufficient – Giving users a selection menu for data collection can be impractical in a healthcare context where granular opt-outs may break essential functionality and introduce usability barriers. Moreover, it shifts the burden of defining data necessity to the user rather than the design team, which may result in uncontrolled collection.Why C is insufficient – Posting a privacy policy is a transparency measure, not a technical safeguard. The policy describes what data may be collected but does not enforce that only the needed categories are actually ingested or processed. It cannot prevent the system from acquiring extraneous data during operation.Implementation tip – Create a data-mapping register that lists each data element (e.g., medication list, allergy status, location, photo), the specific feature it supports (e.g., dosage recommendation engine, provider communication module), and the legal basis for its processing. Review this register during every PbD checkpoint and update it whenever a new feature is added.
International Association of Privacy Professionals (IAPP) – Privacy Impact Assessment Guide: https://iapp.org/resources/default-source/privacy-managementresources/pia-guide.pdf European Commission – General Data Protection Regulation (GDPR) – Article 5(1)(c) – Data minimisation: https://gdpr.eu/article-5/These resources illustrate the legal and methodological foundations for purpose-specific data mapping and minimisation in health-tech applications.
SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.The Privacy Team is conducting a Privacy Impact Assessment (PIA) for the new Light Blue Health application currently in development. Which of the following best describes a risk that is likely to result in a privacy breach?
Why option D is the most appropriate riskThe application will receive electronic health records (EHRs) that contain highly sensitive health data . Under most privacy regimes (e.g., HIPAA, GDPR), protected health information must be protected in transit using strong cryptography. If the data are not encrypted when transmitted from the user’s device to Light Blue Health’s servers, an attacker who intercepts the network traffic could read, modify, or exfiltrate the health records, directly resulting in a privacy breach . Encryption also satisfies the “confidentiality” principle of Privacy-by-Design and is a prerequisite for compliance with data-security requirements in health-care contexts.Why the other options are less relevant as a breach-causing riskA – Limiting access to authorized personnel is actually a protective control; it reduces breach risk rather than introducing a privacy-related hazard. B – Including non-transparent policies can erode user trust and may lead to regulatory scrutiny for lack of transparency, but it does not itself create a technical vector that directly exposes personal data. C – Insufficient deletion of personal data does pose a privacy risk, yet the breach would typically manifest as retained data rather than an active disclosure of data in use. In the scenario, the primary data flow that creates a direct exposure point is the transmission of health records , making encryption the more critical missing safeguard.Conclusion The lack of encryption during data transmission directly enables unauthorized interception of protected health information, making option D the most likely source of a privacy breach in this context.
HIPAA Security Rule – Transmission Security : https://www.hhs.gov/hipaa/for-professionals/security/index.html GDPR Article 32 – Security of Processing : https://eur-lex.europa.eu/eli/reg/2016/679/article/32These sources outline the legal and technical obligations for protecting health-related data in transit, reinforcing why encryption is essential.
SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.Regarding the app, which action is an example of a decisional interference violation?
Answer(s): A
Why option A is the correct example of a decisional interference violationIrrelevant attribute collection – The app requests income level even though the treatment recommendation logic does not require socioeconomic data for medical decision-making. Potential to bias outcomes – Income can steer algorithmic weighting of treatment options, effectively allowing the system to make decisions that are influenced by an unrelated personal characteristic. Violation of purpose-limitation – Under GDPR-style privacy frameworks, processing must be limited to what is necessary for the specified purpose. Collecting income solely to “determine the treatment of care” adds a new, unnecessary purpose that the user never consented to.Decisional interference – By prompting the user to disclose income, the app creates a decision-making lever that can affect the medical advice it provides, which is precisely what the privacy principle seeks to prevent.Why the other options are not decisional interference violationsOption B – Selling aggregated dataThis is a purpose-compatibility or consent issue (lack of consent for secondary use), not an intrusion into the user’s own decision-making process. Option C – Pop-up ad for a newsletterThe ad is an intrusive marketing practice; it breaches user expectations but does not interfere with a clinical or therapeutic decision that the system is authorized to make. Option D – Asking about family medical history not needed for symptom treatmentAlthough the data may be extraneous, family history can sometimes be clinically relevant for risk assessment. The request does not directly bias the algorithmic recommendation with an unrelated attribute the way income does; the core violation hinges on the presence of an irrelevant decision lever.Conclusion Only option A introduces an unnecessary, decision-shaping attribute (income level) that is unrelated to the medical purpose and therefore represents a clear case of decisional interference.
European Data Protection Board (EDPB) – Guidelines on Privacy by Design ( https://edpb.europa.eu/our-work/our-work/our-organisation_en ) IAPP – CIPP/E Body of Knowledge – Module on Purpose Limitation and Data Minimisation ( https://iapp.org/resources/article/cipp-e-body-of-knowledge )
SCENARIOPlease use the following to answer the next question:Light Blue Health (LBH) is a healthcare technology company developing a new web and mobile application that collects personal health information from electronic patient health records. The application will use machine learning to recommend potential medical treatments and medications based on information collected from anonymized electronic health records. Patient users may also share health data collected from other mobile apps with the LBH app. The application requires consent from the patient before importing electronic health records into the application and sharing it with their authorized physicians or healthcare provider. The patient can then review and share the recommended treatments with their physicians securely through the app. The patient user may also share location data and upload photos in the app. The patient user may also share location data and upload photos in the app for a healthcare provider to review along with the health record. The patient may also delegate access to the app. LBH's privacy team meets with the Application development and Security teams, as well as key business stakeholders on a periodic basis. LBH also implements Privacy by Design (PbD) into the application development process.The Privacy Team is conducting a Privacy Impact Assessment (PIA) to evaluate privacy risks during development of the application. The team must assess whether the application is collecting descriptive, demographic or any other user related data from the electronic health records that are not needed for the purposes of the application. The team is also reviewing whether the application may collect additional personal data for purposes for which the user did not provide consent.What is the best way to minimize the risk of an exposure violation through the use of the app?
Answer(s): B
Why option B is the best choiceThe Privacy Impact Assessment flagged the risk that health data stored in the app could be linked to other personally identifying information (PII) and exposed to unauthorised parties. The most direct technical safeguard against an exposure violation is to separate (pseudonymise or fully anonymise) the health data from any personal identifiers before it is processed, stored, or shared.Dissociation removes the ability to re-identify an individual without additional data, thereby reducing the data’s classification from “personal” to a lower-risk category. It aligns with core privacy principles such as data minimisation and purpose limitation under GDPR/HIPAA and supports a “privacy-by-design” architecture. Once the data are dissociated, even if a breach occurs, the exposed dataset cannot be combined with other records to re-identify patients, dramatically lowering the likelihood of an exposure violation.Why the other options are less suitableA – Prevent the downloading of photos stored in the app – This only limits a peripheral functionality (photo handling) and does not address the core risk that health records linked to identifiers could be exposed. It offers limited impact on overall exposure risk. C – Exclude the collection of personal information from the health record – The application must ingest identifiers (e.g., name, medical record number) to link treatment recommendations to the proper patient. Completely excluding such data would cripple the app’s purpose and is not a realistic mitigation technique. D – Create a policy to prevent combining data with external data sources – Policies are administrative controls; they rely on human compliance and do not technically prevent accidental or malicious linkage once data are already merged. An exposure can still occur via internal data stores or through indirect inference.Therefore, dissociating the patient health data from personal data provides the most robust technical control to minimise exposure-related privacy violations while still enabling the app’s intended functionality.
IAPP Privacy by Design Toolkit – Chapter 4: Data Minimisation & Pseudonymisation https://iapp.org/resources/privacy-by-design-toolkit/HIPAA Security Rule Guidance – Addressable Safeguies: Access Control & Encryption (discusses de-identification) https://www.hhs.gov/hipaa/for-professionals/security/index.html
Not updating software for a system that processes human resources data with the latest security patches may create what?
Answer(s): B – Privacy vulnerabilitiesThe primary risk of failing to apply the latest security patches to a system that stores and processes HR data is the creation of exploitable weaknesses that can be leveraged to gain unauthorized access to personally identifiable information (PII). Unpatched software may contain known exploits (e.g., buffer overflows, injection flaws, insecure authentication mechanisms) that attackers can use to circumvent controls, exfiltrate records, or modify data. Such weaknesses directly constitute privacy vulnerabilities because they undermine the confidentiality, integrity, and availability guarantees required by privacy-by-design principles and regulatory frameworks (e.g., GDPR Art. 32, CCPA §1798.150).Why the other choices are less appropriateA: Authentication issues – While unpatched components can affect authentication mechanisms, the overarching classification for the broader impact on data protection is “privacy vulnerability,” not a narrowly scoped authentication flaw. C. Privacy threat vectors – “Threat vector” describes the method or pathway an attacker might use; it is a descriptive term rather than the specific privacy-related condition created by missing patches. The question asks what condition results, not the mechanism itself. D. Reportable privacy violations – A violation implies a breach of law or regulation after an incident occurs. Missing patches are a procedural deficiency that creates risk; they do not automatically constitute a violation until an actual breach or detection event occurs. Hence they are not a direct classification of the risk itself.Conclusion – The omission of timely security updates introduces exploitable weaknesses that jeopardize the confidentiality of HR data, making “privacy vulnerabilities” the most precise and technically accurate description.
European Union Agency for Cybersecurity (ENISA) – Security Vulnerability Management https://www.enisa.europa.eu/publications/security-vulnerability-management International Association of Privacy Professionals (IAPP) – CIPP Body of Knowledge – Chapter 5: Security and Incident Response https://iapp.org/resources/articles/cipp-body-of-knowledge/These resources confirm that unpatched software creates vulnerabilities that can compromise personal data, supporting the justification above.
Post your Comments and Discuss IAPP CIPT exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the CIPT content, but please register or login to continue.