Exam CIPP-US topic 1 question 62 discussion

an organization "Generally NOT" be required to disclose to law enforcement... • D. Personal health information under the HIPAA Privacy Rule HIPAA - Disclosures Permitted by Law For some categories of information, an organization is permitted, BUT NOT REQUIRED(GENERALLY), to disclose personal information It permits (BUT DOES NOT REQUIRE) companies to disclose PHI when required to do so by another applicable law, such as the state laws that require reporting of medical information • C. Information about workplace injuries under OSHA requirements The U.S. Department of Labor’s (DOL’s) Occupational Health and Safety Administration (OSHA) requires compilation and reporting of information about certain workplace injuries and illnesses

A. Information about medication errors under the Food, Drug and Cosmetic Act The U.S. Food and Drug Administration (FDA) requires health professionals and drug manufacturers to report serious adverse events, product problems, or medication errors suspected to be associated with the use of an FDA-regulated drug, biologic, device or dietary supplement under the Food, Drug and Cosmetic Act (FDCA). B. Money laundering information under the Bank Secrecy Act of 1970 Required Disclosure Under Anti-Money- Laundering Laws Financial institutions are also subject to a variety of requirements to retain records and, in some instances, disclose personal financial information to the government. Financial institutions in general have intricate accounting and control systems to document transactions and reduce the risk of fraud.

It is D. For HIPAA even if there is a law enforcement request, the individual needs to be notified in case they want to appeal.

D - Under the HIPAA Privacy Rule, covered entities are not typically required to disclose personal health information (PHI) to law enforcement unless there is a specific reason as defined by the rule (e.g., a court order, warrant, or certain administrative requests). The other choices involve regulatory regimes where disclosures to law enforcement or other governmental authorities are generally expected when specific incidents or issues arise.

The answer is D. These are "permissive" disclosures. The covered entity or business associate may refuse. https://www.eff.org/issues/law-enforcement-access

The answer is not D. Textbook mentions "certain law enforcement activates" as a valid exception to the HIPAA privacy rule.

This question should be "none of the above". On page 347, Section 13.1.1, all of the answers are listed as times when disclosures are required by law.