CIPP-US Question #151: Real Exam Question with Answer & Explanation

Question

Options

• AContact tracing is covered exclusively under the Health Insurance Portability and Accountability
• BContact tracing is regulated by the U.S. Centers for Disease Control and Prevention (CDC).
• CContact tracing is subject to a patchwork of federal and state privacy laws
• DContact tracing is not regulated in the United States.

Explanation

In the United States, pandemic contact-tracing apps are regulated under a patchwork of federal and state privacy laws, rather than a single, comprehensive framework. Contact-tracing initiatives often involve the collection and processing of sensitive data, including location and health information, which may fall under different legal regimes depending on the jurisdiction and type of Key Regulations Affecting Contact-Tracing Apps: State Privacy Laws: States such as California (via the California Consumer Privacy Act - CCPA) and others have privacy laws that may apply to contact-tracing apps, particularly when personal data is collected or shared. State-level health privacy laws may also govern how health-related data is collected HIPAA (Health Insurance Portability and Accountability Act) applies only if the app is used by or on behalf of a covered entity (e.g., healthcare providers or health plans). If the app is operated by a private company without a connection to a HIPAA-covered entity, HIPAA likely does not apply. Federal Guidance: The Federal Trade Commission (FTC) enforces general privacy protections under Section 5 of the FTC Act, which prohibits unfair or deceptive practices. The FTC has also issued guidance on privacy considerations for health-related apps. Other Federal and Sector-Specific Laws: If the app collects health-related data, it could also trigger obligations under laws like the Americans with Disabilities Act (ADA) or sector-specific rules.

No community discussion yet for this question.