Privacy and Security Standards Flashcards
7 cards from real CACS practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Privacy and Security Standards flashcards as text
A consumer wants their CAC to help them understand their Explanation of Benefits (EOB). Under what condition may the CAC view this document?
Answer: Only if the consumer is present and explicitly shares the document with the CAC
EOBs contain PHI, so a CAC may only review them when the consumer voluntarily shares the document and consents to assistance in the moment.
Which of the following is NOT considered Personally Identifiable Information (PII) in the context of Marketplace applications?
Answer: Consumer's favorite color
A consumer's favorite color is not PII because it cannot be used to identify, contact, or locate an individual.
A consumer refuses to sign a privacy notice acknowledgment before receiving CAC assistance. What should the CAC do?
Answer: Provide assistance anyway and note the refusal, since assistance cannot be conditioned on signing
CACs cannot condition the provision of assistance on a consumer signing a privacy notice; they should document the refusal and still provide help.
What is the primary purpose of a CAC providing a consumer with a privacy notice?
Answer: To inform the consumer about how their information will be collected, used, and protected
Privacy notices inform consumers of their rights and explain how the CAC organization collects, uses, and safeguards their personal information.
A CAC overhears a colleague discussing a consumer's income information loudly in a public waiting area. This violates which privacy principle?
Answer: Reasonable safeguards / minimum necessary
Discussing consumer PII in a public area violates the 'reasonable safeguards' and 'minimum necessary' principles by exposing information beyond its intended audience.
Under CMS rules, which of the following entities must CACs report a data breach to?
Answer: To CMS and potentially to affected consumers and HHS depending on the scope
CAC organizations must report breaches to CMS and may also be required to notify affected consumers and HHS's Office for Civil Rights depending on the nature and scale of the breach.
A consumer's authorized representative requests a full copy of all information the CAC organization has on file for that consumer. What should the CAC do?
Answer: Fulfill the request after verifying the representative's authorization documentation
A properly documented authorized representative has the same rights as the consumer, so the CAC should verify their credentials and then fulfill the records request.