Regulatory Compliance Flashcards

Under the Sarbanes-Oxley Act (SOX), how long must public companies retain audit workpapers?

Answer: 7 years

SOX Section 802 requires audit workpapers to be retained for 7 years after the audit or review concludes.

Which HIPAA rule specifically governs the safeguarding of electronic protected health information (ePHI)?

Answer: Security Rule

The HIPAA Security Rule establishes national standards to protect ePHI created, received, used, or maintained by covered entities.

The Freedom of Information Act (FOIA) applies to records held by which type of entity?

Answer: Federal executive branch agencies

FOIA (5 U.S.C. § 552) grants the public the right to request records from federal executive branch agencies.

A records manager discovers that a litigation hold was issued after some responsive documents were already destroyed per the normal retention schedule. What is the most appropriate immediate action?

Answer: Document the destruction and notify legal counsel immediately

When pre-hold destruction occurs, the records manager must document the circumstances and promptly notify legal counsel to assess spoliation risk.

Which regulation requires financial institutions to implement customer information security programs and report breaches to regulators?

Answer: Gramm-Leach-Bliley Act (GLBA)

GLBA's Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program.

Under the Federal Rules of Civil Procedure (FRCP), what term describes the process of identifying, preserving, collecting, and producing electronically stored information?

Answer: e-Discovery

e-Discovery refers to the discovery process as it applies to electronically stored information (ESI) under the FRCP.

Which federal agency enforces HIPAA Privacy and Security Rules?

Answer: Office for Civil Rights (OCR) within HHS

The HHS Office for Civil Rights (OCR) is the primary enforcement agency for HIPAA Privacy and Security Rules.